CVE-2023-33386

MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background...

CVE-2023-33386

MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background...

CVE-2023-3061

A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btnfunctions.php of the component Attachment Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated...

CVE-2023-3061

A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btnfunctions.php of the component Attachment Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated...

CVE-2023-3061 code-projects Agro-School Management System Attachment Image btn_functions.php unrestricted upload

A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btnfunctions.php of the component Attachment Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated...

Agro-School Management System 代码问题漏洞

Agro-School Management System is the Agro-School Management System. code-projects A code issue vulnerability exists in Agro-School Management System version 1.0 due to unknown handling of the file btnfunctions.php in the component Attachment Image Handler, which results in unrestricted uploads...

PT-2023-22807 · Code Projects · Agro-School Management System

Name of the Vulnerable Software and Affected Versions: code-projects Agro-School Management System version 1.0 Description: A critical issue affects the Attachment Image Handler component, specifically the file btn functions.php, leading to unrestricted upload. The attack can be initiated remotel...

DEBIAN-CVE-2023-32685

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the contentEditable element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document...

Cross site scripting

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the contentEditable element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document...

Kiwi TCMS 跨站脚本漏洞

Kiwi TCMS is a leading open source test management system for manual and automated testing from Kiwi TCMS Open Source. A security vulnerability exists in Kiwi TCMS versions prior to 12.3 that stems from allowing users to upload attachments to test plans, test cases, etc., which makes it possible...

CVE-2023-2825

Removed by vendor...

New PowerExchange Backdoor Used in Iranian Cyber Attack on UAE Government

An unnamed government entity associated with the United Arab Emirates U.A.E. was targeted by a likely Iranian threat actor to breach the victim's Microsoft Exchange Server with a "simple yet effective" backdoor dubbed PowerExchange. According to a new report from Fortinet FortiGuard Labs, the...

Tracking down a trojan: An inside look at threat hunting in a corporate network

At Malwarebytes, we talk a lot about the importance of threat hunting for SMBs--and not for no good reason, either. Just consider the fact that, when a threat actor breaches a network, they dont attack right away. The median amount of time between system compromise and detection is 21 days. By th...

VMs Show Gray Screen When Booted Up With vGPU Attached

4 production VMs show Gray screen when booted up with vGPU attached, error message shows in Hypervisor status report: kern.log: May 14 20:33:16 citrix-srv-172 kernel: 1545.091820 nvrm-nvlog: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA May 14 20:33:16 citrix-srv-172 kernel:...

EulerOS Virtualization 2.10.1 : libksba (EulerOS-SA-2023-1904)

According to the versions of the libksba package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be...

EulerOS Virtualization 2.10.0 : libksba (EulerOS-SA-2023-1935)

According to the versions of the libksba package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be...

New Phishing-as-a-Service Platform Lets Cybercriminals Generate Convincing Phishing Pages

A new phishing-as-a-service PhaaS or PaaS platform named Greatness has been leveraged by cybercriminals to target business users of the Microsoft 365 cloud service since at least mid-2022, effectively lowering the bar to entry for phishing attacks. "Greatness, for now, is only focused on Microsof...

PT-2023-22242 · Debian · Debian

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Dispositio...

Position NFT can be spammed with insignificant positions by anyone until rewards DoS

Lines of code Vulnerability details Impact The PositionManager.memorializePositionsparams method can be called by anyone per design, see 3rd party test cases and allows insignificantly small any value 0 positions to be attached to anyone else's positions NFT, see PoC. As a result, the...

GHSA-J9H5-VCGV-2JFM XWiki Platform vulnerable to RXSS via editor parameter - importinline template

Impact It's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. To reproduce: add an attachment to a page for example, your user profile add...