How to configure bookmarks on NetScaler Gateway

This is a step-by-step on how to create bookmarks on the NetScaler and attach those to specific AD groups...

WordPress Plugin Image Optimizer by 10web 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Input validation

Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup...

CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

Intel Manageability Commander Cross-Site Scripting Vulnerability

Intel Manageability Commander is a lightweight console from Intel Corporation USA. for connecting to and using Intel Active Management Technology Intel AMT features. A security vulnerability exists in Intel Manageability Commander versions prior to 2.3. An attacker could exploit the vulnerability...

Intel AMT SDK Security Vulnerability

Intel AMT SDK is an IntelR development kit for providing basic development capabilities for Active Management Technology AMT. A security vulnerability exists in IntelR AMT and IntelR Standard Manageability that originates from incorrect input validation. An attacker could exploit the vulnerabilit...

CVE-2023-31209

Improper neutralization of active check command arguments in Checkmk 2.1.0p32, 2.0.0p38, 2.2.0p4 leads to arbitrary command execution for authenticated users...

CVE-2023-31209 Command injection via active checks and REST API

Improper neutralization of active check command arguments in Checkmk 2.1.0p32, 2.0.0p38, 2.2.0p4 leads to arbitrary command execution for authenticated users...

CVE-2023-31209 Command injection via active checks and REST API

Improper neutralization of active check command arguments in Checkmk 2.1.0p32, 2.0.0p38, 2.2.0p4 leads to arbitrary command execution for authenticated users...

Checkmk Injection Vulnerability

Checkmk is an editor. Checkmk suffers from a security vulnerability that stems from a security issue with the parameter ctive check command, which allows an authenticated attacker to execute arbitrary commands...

SecurityCouncilMemberElectionGovernor Owner Can Change votingPeriod During an Active Election

Lines of code Vulnerability details Impact In SecurityCouncilMemberElectionGovernor contract : relay function enables the contract owner from making calls to any contract address. And in SecurityCouncilMemberElectionGovernorCountingUpgradeable contract: setFullWeightDuration can be accessed only ...

ManageEngine ADManager Plus < Build 7202 Unauthorized Access

Zoho ManageEngine ADManager Plus before version 7.2 Build 7202 is affected by an unauthorized access vulnerability which could allow authenticated users to take over another user's account via sensitive information disclosure. Note that Nessus has not tested for this issue but has instead relied...

CVE-2023-35838

The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while...

Cross site request forgery (csrf)

A cross-site request forgery CSRF token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request. This could...

Understanding Active Directory Attack Paths to Improve Security

Introduced in 1999, Microsoft Active Directory is the default identity and access management service in Windows networks, responsible for assigning and enforcing security policies for all network endpoints. With it, users can access various resources across networks. As things tend to do, times,...

PT-2023-4297 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in Microsoft Exchange Server, which can be exploited by a remote attacker to elevate their privileges. This...

PT-2023-4293

Name of the Vulnerable Software and Affected Versions ASP.NET affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in ASP.NET, which allows attackers to affect the system. This vulnerability is associated with insufficient access controls in...

Metasploit Weekly Wrap-Up

Fly High in the Sky With This New Cloud Exploit! This week, a new module was added that takes advantage of both authentication bypass and command injection in certain versions of Western Digital's MyCloud hardware. Submitted by community member Erik Wynter, this module gains access to the target,...

The vulnerability of the Windows Active Directory (AD) management and reporting software Zoho ManageEngine ADAudit Plus arises due to the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out XSS attacks.

The vulnerability of the Windows Active Directory AD management and reporting software Zoho ManageEngine ADAudit Plus exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...