PT-2023-28274 · Arm · Arm Mali Gpu Kernel Driver

Name of the Vulnerable Software and Affected Versions: Arm Mali GPU Kernel Driver versions affected versions not specified Description: A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. The issue is currently under active...

A broken marriage. Abusing mixed vendor Kerberos stacks

My first DEF CON talk was nerve-racking but something I would definitely put myself through again. In hindsight I should have submitted a 45-minute talk as there were some elements missing from what I presented, based on additional research since submitting the CFP. With that in mind, and for tho...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-38831 RARLAB WinRAR Code Execution Vulnerability CVE-2023-32315 Ignite Realtime Openfire Path Traversal Vulnerability These types of vulnerabilities are freque...

GHSA-CR5Q-6Q9F-RQ6Q Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

PT-2023-26260

Name of the Vulnerable Software and Affected Versions Active Support versions 5.2.0 through 7.0.7.0 Active Support versions 6.1.7.4 and earlier Description The issue arises from ActiveSupport::EncryptedFile writing contents to a temporary file with permissions defaulted to the user's current umas...

Possible File Disclosure of Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

AD_Enumeration_Hunt - Collection Of PowerShell Scripts And Commands That Can Be Used For Active Directory (AD) Penetration Testing And Security Assessment

Description Welcome to the AD Pentesting Toolkit! This repository contains a collection of PowerShell scripts and commands that can be used for Active Directory AD penetration testing and security assessment. The scripts cover various aspects of AD enumeration, user and group management, computer...

Ivanti Warns of Critical Zero-Day Flaw Being Actively Exploited in Sentry Software

Software services provider Ivanti is warning of a new critical zero-day flaw impacting Ivanti Sentry formerly MobileIron Sentry that it said is being actively exploited in the wild, marking an escalation of its security woes. Tracked as CVE-2023-38035 CVSS score: 9.8, the issue has been described...

How to configure bookmarks on NetScaler Gateway

This is a step-by-step on how to create bookmarks on the NetScaler and attach those to specific AD groups...

WordPress Plugin Image Optimizer by 10web 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Input validation

Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup...

CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

Intel Manageability Commander Cross-Site Scripting Vulnerability

Intel Manageability Commander is a lightweight console from Intel Corporation USA. for connecting to and using Intel Active Management Technology Intel AMT features. A security vulnerability exists in Intel Manageability Commander versions prior to 2.3. An attacker could exploit the vulnerability...

Intel AMT SDK Security Vulnerability

Intel AMT SDK is an IntelR development kit for providing basic development capabilities for Active Management Technology AMT. A security vulnerability exists in IntelR AMT and IntelR Standard Manageability that originates from incorrect input validation. An attacker could exploit the vulnerabilit...

CVE-2023-31209

Improper neutralization of active check command arguments in Checkmk 2.1.0p32, 2.0.0p38, 2.2.0p4 leads to arbitrary command execution for authenticated users...

CVE-2023-31209 Command injection via active checks and REST API

Improper neutralization of active check command arguments in Checkmk 2.1.0p32, 2.0.0p38, 2.2.0p4 leads to arbitrary command execution for authenticated users...

CVE-2023-31209 Command injection via active checks and REST API

Improper neutralization of active check command arguments in Checkmk 2.1.0p32, 2.0.0p38, 2.2.0p4 leads to arbitrary command execution for authenticated users...

Checkmk Injection Vulnerability

Checkmk is an editor. Checkmk suffers from a security vulnerability that stems from a security issue with the parameter ctive check command, which allows an authenticated attacker to execute arbitrary commands...