CVE-2023-36568

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability...

Privilege escalation

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability...

CVE-2023-36568 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

...

CVE-2023-36568

CVE-2023-36568 is a Microsoft Office Click-To-Run elevation-of-privilege vulnerability. The CVE entry lists a CVSS v3.1 base score of 7.0 (HIGH) with Local attack vector, high impact to confidentiality, integrity and availability, and requires low privileges with no user interaction; the scope is...

Microsoft Office 安全漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. Microsoft Office Click-To-Run has an elevation of privilege vulnerability that can be exploited by an...

PT-2023-5984 · Microsoft · Office Click-To-Run

Name of the Vulnerable Software and Affected Versions: Microsoft Office Click-To-Run affected versions not specified Description: The issue is related to insufficient access restrictions in the Click-to-Run C2R component of Microsoft Office and Office 365. Exploitation of this issue may allow an...

CVE-2023-36568: Improper Link Resolution Before File Access

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability...

PT-2023-31744 · Sick · Sick Apu Rdt400

Name of the Vulnerable Software and Affected Versions: SICK APU RDT400 affected versions not specified Description: The issue allows an unprivileged remote attacker to potentially reveal sensitive information by tricking a user into clicking on an actionable item using an iframe. This is due to...

CSRF in Payment Types

Description CSRF in Payment Types Proof of Concept 1 .Attacker send form fake to user history.pushState'', '', '/'; document.forms0.submit; 2 .User click , edited unwanted payment types Video Poc https://drive.google.com/file/d/1jI4bW5BJXGdJ7kICI-K1Kmg5y2EPw7f0/view?usp=sharing Payload Poc...

CVE-2023-41856 WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ClickToTweet.Com Click To Tweet plugin = 2.0.14 versions...

CVE-2023-41856 WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ClickToTweet.Com Click To Tweet plugin = 2.0.14 versions...

The right-click does not work on the start menu of Windows 11.

Right-click does not work on the start menu of Windows 11. This issue only occurs when VDA is installed. Uninstall VDA or VDA not installed environments do not cause this issue...

CVE-2023-41856: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ClickToTweet.Com Click To Tweet plugin = 2.0.14 versions...

WordPress Plugin Click To Tweet Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-28122 · WordPress · Click To Tweet

Name of the Vulnerable Software and Affected Versions: Click To Tweet plugin versions = 2.0.14 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

Critical libwebp Vulnerability Under Active Exploitation - Gets Maximum CVSS Score

Google has assigned a new CVE identifier for a critical security flaw in the libwebp image library for rendering images in the WebP format that has come under active exploitation in the wild. Tracked as CVE-2023-5129, the issue has been given the maximum severity score of 10.0 on the CVSS rating...

WordPress Track The Click Plugin < 0.3.12 is vulnerable to SQL Injection

Software Track The Click Type Plugin Vulnerable versions 0.3.12 Fixed in 0.3.12 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5041 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 1853e39ba601 Credits Karolis Narvilas Required privilege Author Publish...

Google libwebp open source library remote code execution vulnerability

WebP is an image format developed by Google, which supports lossy and lossless compression of network images, and its compression effect and speed have certain advantages over PNG and JPEG formats. libwebp is a C/C++ open source library that implements the coding and decoding of the WebP image...

Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection

Description The plugin does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database. Version 0.3.11 changes the API endpoint to only be...

Store XSS at Label sets list in (Version 6.2.7)

Description First of all, I apologize for reporting back. I noticed, the latest current version is 6.2.7. XSS vulnerabilities still exist Proof of Concept Detail: 1 .Login and access Label sets list 2 .Create new label set 3 . Insert payload in to Title haido" onclick="alert1 4 .Click save ==...