PT-2023-6106 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View affected versions not specified Description: The vulnerability resides within the coreservice action script action of the D-Link D-View platform. It involves the exposure of a dangerous function, allowing remote attackers to...

PT-2023-5887 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View affected versions not specified Description: This issue allows remote attackers to create a denial-of-service condition on affected installations of D-Link D-View. The specific flaw exists within the shutdown coreserver action,...

PT-2023-7299 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a heap buffer overflow in the Bluetooth component of the Android operating system. This could lead to a local escalation of privilege, with System execution privileg...

Pleasant Solutions Pleasant Password Server Cross-Site Scripting Vulnerability

Pleasant Solutions Pleasant Password Server is a proprietary multi-user enterprise password server from Pleasant Solutions. A security vulnerability exists in Pleasant Solutions Pleasant Password Server version v7.11.41.0, which originates from a cross-site scripting XSS vulnerability in the...

CISA Known Exploited Vulnerability Catalog September 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...

PT-2023-7964 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: The issue is related to a use-after-free vulnerability in the handling of Doc objects within Foxit PDF Reader and Foxit PDF Editor...

MAL-2023-8275 Malicious code in jsonpjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8597bb87092b400a3e1a8789fa9cc44d28b77991870740d6d524c493feac5339 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-5313 phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique action

A vulnerability classified as problematic was found in phpkobo Ajax Poll Script 3.18. Affected by this vulnerability is an unknown functionality of the file ajax-poll.php of the component Poll Handler. The manipulation leads to improper enforcement of a single, unique action. The attack can be...

CVE-2023-5313 phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique action

A vulnerability classified as problematic was found in phpkobo Ajax Poll Script 3.18. Affected by this vulnerability is an unknown functionality of the file ajax-poll.php of the component Poll Handler. The manipulation leads to improper enforcement of a single, unique action. The attack can be...

CVE-2023-5287

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/admincontenttag.php?action=savecontent. The manipulation of the argument tag leads to cross site scripting. It is possible to initiate the attac...

CVE-2023-5268

A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/makehtmltaglistaction.php. The manipulation of the argument mktime leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to...

WordPress Magic Action Box Plugin <= 2.17.2 is vulnerable to Cross Site Scripting (XSS)

Software Magic Action Box Type Plugin Vulnerable versions = 2.17.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5231 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2d85f5acc350 Credits Lana Codes Required...

CVE-2023-44121

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

CVE-2023-40048

In WSFTP Server version prior to 8.8.2, the WSFTP Server Manager interface was missing cross-site request forgery CSRF protection on a POST transaction corresponding to a WSFTP Server administrative function...

Malwarebytes Admin update: New Detection screens to manage threats!

We released version 1.2 of the Malwarebytes Admin app for iOS and Android last week, adding new Detection features make it easier to see and manage threats. Designed as a companion to the Nebula console, Malwarebytes Admin allows administrators to quickly review, investigate, and resolve security...

MAL-2023-8240 Malicious code in peekatchuysharnlesspackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4db2b740e4d7fc22fc59a9c9791266dadf9ef6b050ec445676abbe682c6a141 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8238 Malicious code in manhdzfca (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 957bf8a2482f5b5f075c546737a5eb4b845abb4e402d13e458b52f091496b073 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insufficient Session Expiration

Description User's action is still vaild when admin changed privileges. Proof of Concept 1. Admin create user1 and grant all privileges. 2. go into incognito mode and login as user1 then go to user list page. 3. admin create user2 and in user1 browser refresh the page to see user2. 4. Then admin...

The vulnerability in the compress-inc.php script of the application for uploading and downloading files for shared use with Openupload allows a perpetrator to execute arbitrary code.

The vulnerability of the compress-inc.php script used for downloading and saving files for shared use with Openupload is related to the unlimited download of dangerous types of files when the action parameter with a value of compress=0 is processed. Exploiting this vulnerability could allow an...

CVE-2023-38344

An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an...