Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux

Traditional obfuscation techniques tend to add layers to encapsulate standing code, such as base64 or compression. These payloads do continue to have a varied degree of success, but they have become trivial to extract the intended payload and some launchers get detected often, which essentially...

SUSE CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

WordPress Lazy Social Comments Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Lazy Social Comments Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23733 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 809f9989685a Credits yuyudhn Required...

Lazy Social Comments <= 2.0.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-1250

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

CVE-2023-1250 Code execution through ACL creation

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

Typecho 跨站脚本漏洞

typecho is a PHP blogging platform for typecho individual developers. It is simple and powerful. A security vulnerability exists in Typecho version v.1.2.0. An attacker can exploit this vulnerability to execute arbitrary code via the Comment Manager /admin/manage-comments.php component...

Atlassian Jira < 7.13.12 Comment Permissions Broken Access Control

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.13.12, 8.0.0 prior to 8.5.4 or 8.6.0 prior to 8.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to make comments on a ticket to whi...

DEBIAN-CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

UBUNTU-CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

PT-2023-21600 · Webpack +3 · Webpack +3

Name of the Vulnerable Software and Affected Versions: Webpack versions prior to 5.76.0 Description: The issue concerns cross-realm object access. Specifically, the ImportParserPlugin.js mishandles the magic comment feature, allowing an attacker who controls a property of an untrusted object to...

Atlassian Confluence 4.3.x < 6.2.1 Access Restriction Bypass using watch notifications

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.2.1. It is, therefore, affected by access restriction bypass using watch notifications which may permit an attacker to receive workbox notifications containing the...

closeTrove never nulls trove.stake

Lines of code Vulnerability details // Auditor's note: not 100% sure if this is intentional, but I have reason to believe it's a mistake. Description When a trove gets liquidated, its stake gets set to 0 through removeStake, called eg here. However, when a trove gets closed gratiously through...

Cross site scripting

A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress. This affects an unknown part of the file subscribe-to-comments.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading t...

CVE-2006-10001

CVE-2006-10001 affects the WordPress plugin “Subscribe to Comments” up to version 2.0.7, where an issue in the file subscribe-to-comments.php enables cross-site scripting. The vulnerability can be triggered remotely, with the impact described as causing client-side script execution. A fix is avai...

PT-2023-9859 · WordPress · Subscribe To Comments Plugin

Name of the Vulnerable Software and Affected Versions: Subscribe to Comments Plugin versions up to 2.0.7 Description: A problematic vulnerability was found in the Subscribe to Comments Plugin, affecting an unknown part of the file subscribe-to-comments.php. The manipulation leads to cross site...

WordPress Plugin Subscribe to Comments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

GHSA-9CQM-5WF7-WCJ7 XWiki Platform users may execute anything with superadmin right through comments and async macro

Impact Comments are supposed to be executed with the right of superadmin but in restricted mode anything dangerous is disabled but the async macro is not taking into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki conten...

CVE-2023-26471

XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode anything dangerous is disabled, but the async macro does not take into account the restricted mode. This means that any user with...

CVE-2023-26471 XWiki Platform users may execute anything with superadmin right through comments and async macro

XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode anything dangerous is disabled, but the async macro does not take into account the restricted mode. This means that any user with...