New Backdoor Targets French Entities via Open-Source Package Installer

Researchers have exposed a new targeted email campaign aimed at French entities in the construction, real estate, and government sectors that leverages the Chocolatey Windows package manager to deliver a backdoor called Serpent on compromised systems. Enterprise security firm Proofpoint attribute...

NS WooCommerce Watermark <= 2.11.3 - Abuse of Functionality

An unprivileged user could use the functionality of the plugin to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain. Search for a vulnerable domain with the dork:...

CVE-2022-26967

GPAC 2.0 allows a heap-based buffer overflow in gfbase64encode. It can be triggered via MP4Box...

DEBIAN-CVE-2022-26967

GPAC 2.0 allows a heap-based buffer overflow in gfbase64encode. It can be triggered via MP4Box...

PT-2022-18146 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.0 Description: The issue is a heap-based buffer overflow in the gf base64 encode function. It can be triggered via MP4Box. Recommendations: For GPAC version 2.0, at the moment, there is no information about a newer version that...

WordPress WP Accessibility Helper plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.A cross-site scripting vulnerability exists in versions of the WordPress WP Accessibility Helper plugin prio...

Improper Resolution of Path Equivalence

DESCRIPTION Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. This behavior can be...

CVE-2022-0150

The WP Accessibility Helper WAH WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0150

The WP Accessibility Helper WAH WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue...

Swift Sensors Gateway device password generation authentication bypass vulnerability

Summary An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability. Tested Version...

aide security update

0.14-11.0.1 - precalculate buffer size in base64 functions Orabug: 33835910CVE-2021-45417...

SUSE-SU-2022:0150-2 Security update for aide

This update for aide fixes the following issues: - CVE-2021-45417: Fix a bufferoverflow in base64 functions bsc1194735...

Security update for aide (important)

openSUSE Security Update: Security update for aide Announcement ID: openSUSE-SU-2022:0150-2 Rating: important References: 1194735 Cross-References: CVE-2021-45417 CVSS scores: CVE-2021-45417 SUSE: 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 An update that...

CVE-2022-24982

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials...

CVE-2022-24982

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials...

Design/Logic Flaw

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials...

JqueryForm.com Jquery Form Builder 安全漏洞

JqueryForm.com Jquery Form Builder is a form builder from JqueryForm.com, Inc. An information disclosure vulnerability exists in the JqueryForm.com Jquery Form Builder, which stems from forms generated by JQueryForm.com prior to February 5, 2022 that allow a remote authenticated attacker to acces...

aide: heap-based buffer overflow on outputs larger than B64_BUF

A heap-based buffer overflow vulnerability in the base64 functions of AIDE, an advanced intrusion detection system. An attacker could crash the program and possibly execute arbitrary code through large 16k extended file attributes or ACL...

CVE-2022-0162

The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perfo...

CVE-2022-0162

CVE-2022-0162 affects the TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router, due to transmission of authentication information in cleartext/base64. A remote attacker could intercept credentials and then perform administrative operations on the device via the web-based managemen...