ConEmu Security Breach

ConEmu is a Windows console emulator with tabs by the individual developer Maksim Moisiuk. A security vulnerability exists in versions prior to ConEmu 230724, which stems from an inability to properly clean up the header response for control characters, which could lead to arbitrary code executio...

zeek -- potential DoS vulnerabilities

Tim Wojtulewicz of Corelight reports: File extraction limits were not correctly enforced for files containing large amounts of missing bytes. Sessions are sometimes not cleaned up completely within Zeek during shutdown, potentially causing a crash when using the -B dpd flag for debug logging. A...

WordPress plugin Google Maps Plugin by Intergeo Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. uninstall is one of the plugins used to completely uninstall WordPress. WordPress...

WordPress plugin MapPress Maps for WordPress Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Crow Injection Vulnerability

Crow is a C++ microframework for running Web services. A security vulnerability exists in Crow that stems from vulnerability to HTTP response splitting when header values are constructed using untrusted user input, and header values in the setheader and addheader functions are not properly cleane...

Malicious code in web3tool-providers-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1728380aea0ef49ccdd469e28f2ce128f28bd46843f086103098fab9badafab7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @huoshanjiebai/ethereumjs-utill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7a36fccca657e26ff9ded801631d537ad159e26045c0be4de99b31d351e20d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

HTTP-Shell - MultiPlatform HTTP Reverse Shell

HTTP-Shell is Multiplatform Reverse Shell. This tool helps you to obtain a shell-like interface on a reverse connection over HTTP. Unlike other reverse shells, the main goal of the tool is to use it in conjunction with Microsoft Dev Tunnels, in order to get a connection as close as possible to a...

Splunk Web Arbitrary Command Execution

The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the failure to take measures for data cleanup at the management level due to the use of an outdated version of the runshellscript command. Exploiting this vulnerability allows a remote...

PT-2023-24813

Name of the Vulnerable Software and Affected Versions Arm affected versions not specified Description The issue arises from the arithmetics in the cache cleaning and invalidation helpers provided by Arm, which can overflow and result in skipping the cache cleaning/invalidation. This means there i...

IBM Sterling Secure Proxy Security Vulnerability

IBM Sterling Secure Proxy is an International Business Machines IBM application agent used to ensure the secure transfer of files in an organization's unprotected zone DMZ. A security vulnerability exists in IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0, which stems from an inadequate memory...

WordPress plugin File Sharing Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin CHP Ads Block Detector has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress plugin WooCommerce PDF Invoice Builder has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF...

WordPress Plugin Order Tracking Pro has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress Plugin Order Tracking Pro has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

libvirt: Memory leak in virPCIVirtualFunctionList cleanup

A vulnerability was found in libvirt. This security flaw occurs due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's gautoptr cleanup...

libp2p nodes vulnerable to OOM attack

Summary In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. It is feasible to do this at scale. An attacker would have to transfe...

GHSA-GCQ9-QQWX-RGJ3 libp2p nodes vulnerable to OOM attack

Summary In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. It is feasible to do this at scale. An attacker would have to transfe...

Malicious code in funcraft-api-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a26cfbee7915882a36f6b1213f8779104f879b89ffc82f599aeecde077717859 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...