6717 matches found
[SECURITY] Fedora 38 Update: php-phpmailer6-6.8.1-1.fc38
PHPMailer - A full-featured email creation and transfer class for PHP Class Features Probably the world's most popular code for sending email from PHP! Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more Integrated SMTP support - send without a local...
VulnCheck KEV: CVE-2023-41061
Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064...
PT-2023-5027 · Apple · Ios +2
Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 16.6.1 Apple iPadOS versions prior to 16.6.1 Apple watchOS versions prior to 9.6.2 Description: A validation issue was addressed with improved logic. This issue may result in arbitrary code execution when a...
Apple watchOS 安全漏洞
iOS is a mobile operating system developed by Apple. iPadOS is a family of mobile operating systems developed by Apple based on iOS. watchOS is the operating system for Apple Watch. Arbitrary code execution vulnerability exists in several Apple products, which can be exploited by an attacker to...
New Wave of Attack Campaign Targeting Zimbra Email Users for Credential Theft
A new "mass-spreading" social engineering campaign is targeting users of the Zimbra Collaboration email server with an aim to collect their login credentials for use in follow-on operations. The activity, active since April 2023 and still ongoing, targets a wide range of small and medium business...
CVE-2023-39973 Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns...
Mattermost Server < 7.8.8 / 7.9.x < 7.9.6 / 7.10.x < 7.10.4 Multiple Vulnerabilities
The version of Mattermost Server running on the remote host is prior to 7.8.8, 7.9.x prior to 7.9.6 or 7.10.x prior to 7.10.4. It is, therefore, affected by multiple vulnerabilities: - Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged...
CVE-2023-0551 REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments...
CVE-2023-0551 REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments...
PT-2023-16356 · WordPress · Rest Api To Miniprogram
Name of the Vulnerable Software and Affected Versions: REST API TO MiniProgram WordPress plugin versions through 4.6.1 Description: The issue concerns a lack of authorization and CSRF checks in an AJAX action within the REST API TO MiniProgram WordPress plugin. This allows any authenticated users...
GHSA-G3V6-R8P9-WXG9 Mattermost fails to correctly delete attachments
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...
Code injection
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...
CVE-2023-4105
Mattermost Server vulnerability CVE-2023-4105: In Mattermost Server 7.x prior to 7.8.8, 7.9.x prior to 7.9.6, and 7.10.x prior to 7.10.4, attachments are not removed when deleting a thread message, allowing a simple user to still access/download the deleted message’s attachment. Root cause: failu...
CVE-2023-4105 Attachment of deleted message in a thread remains accessible and downloadable
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...
CVE-2023-4105 Attachment of deleted message in a thread remains accessible and downloadable
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...
CVE-2023-4105 Attachment of deleted message in a thread remains accessible and downloadable
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...
WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)
Software WooCommerce Product Attachment Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-40212 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8ec007daa0bf Credits Mika...
Mattermost Security Vulnerabilities
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that arises from the deletion of a message in a thread without the attachment being deleted, allowing normal users to still access and download the...
New Attack Alert: Freeze[.]rs Injector Weaponized for XWorm Malware Attacks
Malicious actors are using a legitimate Rust-based injector called Freeze.rs to deploy a commodity malware called XWorm in victim environments. The novel attack chain, detected by Fortinet FortiGuard Labs on July 13, 2023, is initiated via a phishing email containing a booby-trapped PDF file. It...
