GSD-2023-1001818 mm: Always release pages to the buddy allocator in memblock_free_late().

mm: Always release pages to the buddy allocator in memblockfreelate. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.229 by commit...

GSD-2023-1001720 mm: Always release pages to the buddy allocator in memblock_free_late().

mm: Always release pages to the buddy allocator in memblockfreelate. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.7 by commit...

PT-2023-34796 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to the memblock free late function, where pages are not always released to the buddy allocator. This could potentially lead to security vulnerabilities, although the actu...

WordPress MainWP Buddy Extension Plugin <= 4.0.1 is vulnerable to Broken Access Control

Software MainWP Buddy Extension Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23747 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 02ced2ec53b5 Credits Dave Jong...

New Cryptojacking Campaign Targeting Vulnerable Docker and Kubernetes Instances

A new cryptojacking campaign has been uncovered targeting vulnerable Docker and Kubernetes infrastructures as part of opportunistic attacks designed to illicitly mine cryptocurrency. Cybersecurity company CrowdStrike dubbed the activity Kiss-a-dog, with its command-and-control infrastructure...

new packages: byte-buddy

An update is available for byte-buddy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

20K WordPress Sites Exposed by Insecure Plugin REST-API

More than 20,000 WordPress sites are vulnerable to malicious code injection, phishing scams and more as the result of a high-severity cross-site scripting XSS bug discovered in the WordPress Email Template Designer – WP HTML Mail, a plugin for designing custom emails. The new vulnerability...

Cross-Site Request Forgery (CSRF) in babybuddy/babybuddy

✍️ Description You don't check CSRF token in following endpoint /timers/add/quick/ with PoC.html attacker able to add quick timers. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' 💥 Impact This vulnerability is capable of ad quick timers...

helper_project (1.3.0), twitter-buddy (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via requst (0.0.1-security)

requst NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on requst and may be impacted: - helperproject 1.3.0 - twitter-buddy =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-8QX4-R7FX-XC4V...

Ghost hardware. Device No.2, the Boo Buddy

The “Boo Buddy” is sold as a “trigger object” with a wide range of internal functionality such as EMF, motion and temperature detection. It’s a “trigger object”, in the sense that it is designed to evoke the spirits of children, who might be drawn in by the presence of a toy. Many people have...

Hacking ghost hunters

We’ve been looking at the security of smart ghost hunting tech. The results were a bit… spooky. TL;DR We bought three devices online. One was a camera for taking photos of ghosts, another was a smart teddy bear for helping ghosts of children apparate, the last a ghost hunting tank camera: In some...

Vastal I-Tech Buddy Zone Facebook Clone SQL Injection Vulnerability

Vastal I-Tech Buddy Zone Facebook Clone is a set of scripts for online social networking sites. A SQL injection vulnerability exists in Vastal I-Tech Buddy Zone Facebook Clone version 2.9.9. The vulnerability can be exploited by a remote attacker by sending the 'requestid' parameter to the...

CVE-2018-6367

SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chatim/chatwindow.php requestid parameter or the /searchevents.php category parameter...

CVE-2018-6367

SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chatim/chatwindow.php requestid parameter or the /searchevents.php category parameter...

Sql injection

SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chatim/chatwindow.php requestid parameter or the /searchevents.php category parameter...

CVE-2018-6367

SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chatim/chatwindow.php requestid parameter or the /searchevents.php category parameter...

CVE-2018-6367

CVE-2018-6367 is a confirmed SQL injection in the Vastal I-Tech Buddy Zone Facebook Clone version 2.9.9. The vulnerability is triggered via the /chat_im/chat_window.php with the request_id parameter or via the /search_events.php with the category parameter. The NVD entry reports a CVSS v3.0 base ...

Buddy Zone 2.9.9 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Vastal I-Tech Facebook Clone 2.9.9 - SQL Injection Dork: N/A Vendor Homepage: http://vastal.com/ Software Link: http://vastal.com/buddy-zone-social-networking-script.html Version: 2.9.9 Category: Webapps Tested on:...

Buddy Zone 2.9.9 - SQL Injection

Buddy Zone 2.9.9 - SQL Injection Exploit Title: Vastal I-Tech Facebook Clone 2.9.9 - SQL Injection Dork: N/A Date: 27.01.2018 Vendor Homepage: http://vastal.com/ Software Link: http://vastal.com/buddy-zone-social-networking-script.html Version: 2.9.9 Category: Webapps Tested on:...

buddy-ch.com XSS vulnerability

Open Bug Bounty ID: OBB-332518 Description| Value ---|--- Affected Website:| buddy-ch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...