CVE-2023-43295

Cross Site Request Forgery vulnerability in Click Studios SA Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request...

CVE-2023-43295

CVE-2023-43295 describes a Cross Site Request Forgery vulnerability in Passwordstate by Click Studios (SA) Pty Ltd, affecting Core Passwordstate builds 9785 and earlier. The issue enables a local attacker to trigger arbitrary code execution via a crafted request. Affected software: Passwordstate ...

iOS Zero-Day Attacks: Experts Uncover Deeper Insights into Operation Triangulation

The TriangleDB implant used to target Apple iOS devices packs in at least four different modules to record microphone, extract iCloud Keychain, steal data from SQLite databases used by various apps, and estimate the victim's location. The new findings come from Kaspersky, which detailed the great...

The outstanding stealth of Operation Triangulation

Introduction In our previous blogpost on Triangulation, we discussed the details of TriangleDB, the main implant used in this campaign, its C2 protocol and the commands it can receive. We mentioned, among other things, that it is able to execute additional modules. We also mentioned that this...

CVE-2023-5701: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Markdown File Handler. The manipulation with the input Click here leads to cross site scripting. The attack can be launched...

WordPress Plugin Waiting: One-click countdowns Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Waiting: One-click...

CVE-2022-4954: Improper Neutralization of Input During Web Page Generation

The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

The vulnerability of the Click-to-Run components of Microsoft Office and Office 365 allows attackers to enhance their privileges.

The vulnerability of the Click-to-Run components of Microsoft Office and Office 365 is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially crafted file...

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. Microsoft Office Click-To-Run has an elevation of privilege vulnerability that can be exploited by an...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Oct 2023)

This host is missing a critical security update according to Microsoft Office Click-to-Run update October 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

CVE-2023-36568

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability...

CVE-2023-36568

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability...

Privilege escalation

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability...

CVE-2023-36568

CVE-2023-36568 is a Microsoft Office Click-To-Run elevation-of-privilege vulnerability. The CVE entry lists a CVSS v3.1 base score of 7.0 (HIGH) with Local attack vector, high impact to confidentiality, integrity and availability, and requires low privileges with no user interaction; the scope is...

CVE-2023-36568 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

...

Microsoft Office 安全漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. Microsoft Office Click-To-Run has an elevation of privilege vulnerability that can be exploited by an...

PT-2023-5984 · Microsoft · Office Click-To-Run

Name of the Vulnerable Software and Affected Versions: Microsoft Office Click-To-Run affected versions not specified Description: The issue is related to insufficient access restrictions in the Click-to-Run C2R component of Microsoft Office and Office 365. Exploitation of this issue may allow an...

CVE-2023-36568: Improper Link Resolution Before File Access

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability...

PT-2023-31744 · Sick · Sick Apu Rdt400

Name of the Vulnerable Software and Affected Versions: SICK APU RDT400 affected versions not specified Description: The issue allows an unprivileged remote attacker to potentially reveal sensitive information by tricking a user into clicking on an actionable item using an iframe. This is due to...

CSRF in Payment Types

Description CSRF in Payment Types Proof of Concept 1 .Attacker send form fake to user history.pushState'', '', '/'; document.forms0.submit; 2 .User click , edited unwanted payment types Video Poc https://drive.google.com/file/d/1jI4bW5BJXGdJ7kICI-K1Kmg5y2EPw7f0/view?usp=sharing Payload Poc...