Users vulnerable to unaligned read of `*const *const c_char` pointer

Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior. In some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in some other way, including the possibilit...

ProtonMail Code Vulnerabilities Leaked Emails

By Waqas Key Findings ProtonMail, a popular Swiss-based email service that markets itself as a secure and private alternative to… This is a post from HackRead.com Read the original post: ProtonMail Code Vulnerabilities Leaked Emails...

Owner cannot rescueToken if blocklisted.

Lines of code Vulnerability details Impact Token could be stuck if owner is blocklisted by the token. Proof of Concept rescueToken can be used to rescue token sent to the contracts. function rescueTokensaddress token external onlyOwner uint256 balance = IRWALiketoken.balanceOfaddressthis;...

CVE-2023-39967

WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via...

Design/Logic Flaw

WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via...

GHSA-FM4Q-J8G4-C9J4 Apache Superset Improper Input Validation vulnerability

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

CVE-2023-39265 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

JVN#92720882: Multiple vulnerabilities in CGIs of PMailServer and PMailServer2

CGIs included with PMailServer and PMailServer2 provided by A.K.I Software contain multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-39223 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVS...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, stems from the lack of measures to neutralize XSS alternative syntax. This allows attackers to replace the displayed URL with their own malicious content.

The vulnerability of the XWiki Platform lies in the lack of measures taken to neutralize the XSS alternative syntax. Exploiting this vulnerability allows a malicious actor to substitute the displayed URL with another value...

The vulnerability of the XWiki platform for creating collaborative web applications lies in its lack of measures to neutralize alternative syntaxes that constitute XSS attacks. This allows attackers to replace the displayed URL.

The vulnerability of the XWiki Platform lies in the lack of measures taken to neutralize the XSS alternative syntax. Exploiting this vulnerability allows a malicious actor to substitute the displayed URL with another value...

DEBIAN-CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

Cross site scripting

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

CVE-2023-40030 Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

JVN#55217369: Rakuten WiFi Pocket vulnerable to improper authentication

Rakuten WiFi Pocket provided by Rakuten Mobile, Inc. is a mobile router. Management Screen of Rakuten WiFi Pocket contains an improper authentication vulnerability CWE-287. Impact An attacker who can access the product may log in to the product's Management Screen. As a result, sensitive...

WordPress RSS Redirect & Feedburner Alternative Plugin <= 3.7 is vulnerable to Broken Access Control

Software RSS Redirect & Feedburner Alternative Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6e5bdc6d7d15 Credits WordFence...

WordPress RSS Redirect & Feedburner Alternative Plugin <= 3.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software RSS Redirect & Feedburner Alternative Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b0595f356de3 Credits...

Remote code execution

vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive insid...

WordPress Independent Analytics - Google Analytics Alternative for WordPress Plugin < 1.26.0 is vulnerable to Cross Site Scripting (XSS)

Software Independent Analytics - Google Analytics Alternative for WordPress Type Plugin Vulnerable versions 1.26.0 Fixed in 1.26.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WormGPT – The Malicious ChatGPT Alternative Empowering Cybercriminals

By Waqas Malicious AI Unleashed: WormGPT Raises Concerns in Cybersecurity! This is a post from HackRead.com Read the original post: WormGPT - The Malicious ChatGPT Alternative Empowering Cybercriminals...

Don't Join Threads—Make Instagram's 'Twitter Killer' Join You

Meta’s Twitter alternative promises that it will work with decentralized platforms, giving you greater control of your data. You can hold the company to that—if you don't sign up...