archive-it.org Cross Site Scripting vulnerability OBB-3394648

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Satacom delivers browser extension that steals cryptocurrency

Satacom downloader, also known as LegionLoader, is a renowned malware family that emerged in 2019. It is known to use the technique of querying DNS servers to obtain the base64-encoded URL in order to receive the next stage of another malware family currently distributed by Satacom. The Satacom...

PT-2023-22802 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 4.0.0 through 4.0.9 Apache Cassandra versions 4.1.0 through 4.1.1 Description: The issue is related to privilege escalation when enabling FQL/Audit logs, allowing a user with JMX access to run arbitrary commands as t...

CVE-2023-30571

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask call inside archivewritediskposix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race...

Don't Click That ZIP File! Phishers Weaponizing .ZIP Domains to Trick Victims

A new phishing technique called "file archiver in the browser" can be leveraged to "emulate" a file archiver software in a web browser when a victim visits a .ZIP domain. "With this phishing attack, you simulate a file archiver software e.g., WinRAR in the browser and use a .zip domain to make it...

PT-2023-4600 · Unknown +3 · Libarchive +3

Name of the Vulnerable Software and Affected Versions: Libarchive versions 3.6.2 and earlier Description: The issue is caused by a race condition with the umask call inside archive write disk posix.c, which can lead to a permanent umask 0 setting. This can result in implicit directory creation wi...

libarchive 竞争条件问题漏洞

libarchive is a multi-format archive and compression library. A security vulnerability exists in libarchive 3.6.2 and earlier versions, which stems from a problem with the archivewritediskposix.c file, and can be exploited by an attacker to delete or rename files in a directory...

Talend Data Catalog 安全漏洞

Talend Data Catalog is a tool that combines data cataloging and metadata management from Talend. It is used to connect data from platforms, databases, and analytic tools to generate a holistic view of the information supply chain in a language everyone can understand. A security vulnerability...

Debian: Security Advisory (DLA-3432-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

Design/Logic Flaw

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

CVE-2023-2868

A remote command injection vulnerability exists in the Barracuda Email Security Gateway appliance form factor only product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file tape archives. The vulnerability ste...

CVE-2022-41221

The CVE-2022-41221 issue affects OpenText Archive Center Administration client versions up to 21.2, where authenticated users can upload XML files that are not properly validated, enabling XXE attacks that may lead to data exfiltration or localized DoS. Root cause: insufficient XML validation. Mi...

OpenText Archive Center Administration 代码问题漏洞

OpenText Archive Center Administration is an archive center administration from OpenText Canada. A security vulnerability exists in OpenText Archive Center Administration version 21.2 and prior versions. An attacker could exploit the vulnerability to upload a specially crafted XML file to an...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

PT-2023-13967 · Opentext · Opentext Archive Center Administration

Name of the Vulnerable Software and Affected Versions: OpenText Archive Center Administration versions prior to 21.3 Description: The issue allows XXE attacks, where authenticated users could upload XML files that are not sufficiently validated, potentially leading to data exfiltration or localiz...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

WordPress Backup Migration 1.2.8 Plugin - Unauthenticated Database Backup Vulnerability

Exploit Title: WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup Google Dork: intitle:"Index of /wp-content/plugins/backup-backup" AND inurl:"plugins/backup-backup/" Exploit Author: Wadeek Vendor Homepage: https://backupbliss.com/ Software Link:...