Design/Logic Flaw

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others...

CVE-2023-1523

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others...

CVE-2023-1523

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others...

CVE-2023-1523

CVE-2023-1523 affects the snapd sandbox via the TIOCLINUX ioctl. A malicious snap could inject into the terminal input and cause arbitrary commands to execute outside the sandbox after the snap exits, with no impact on graphical terminal emulators (e.g., xterm, GNOME Terminal) and exploitation li...

CVE-2023-1523

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others...

Store Front Server Group Server is not reachable. Configuration settings might be out of date.

When observing the Server Group in the StoreFront management console, for each Server Member server the notification "Server is not reachable. Configuration settings might be out of date." is displayed with a red exclamation point icon. When initiating propagation theStoreFront management console...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.10 security update

Red Hat OpenShift Container Platform release 4.13.10 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File Upload

Description The plugin does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution. PoC NOTE: Because of an error in this version of the plugin, the following POC only works on PHP versions previous to 8.0. 1. As an...

kernel: when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds

An out-of-bounds write flaw was found in the Linux kernel’s console driver functionality in the way a user triggers the ioctl PIOFONT with malicious data. This flaw allows a local user to crash or potentially escalate their privileges on the system...

Unable to launch the PVS console. Error: "Unable to connect to the Domain Controller.."

After completing the PVS configuration Wizard using a service account within the same domain as the PVS server, the administrators are unable to launch the PVS console and observe the error - "Unable to connect to the Domain Controller if any or the default rootDSE. Error code: 44936673, message:...

Malicious code in node-hide-console-windows (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffa61f9df29f0ec2845ac6191bc7bcf26ddfd4901abd17d21359a4c5c4cd2a6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7938 Malicious code in node-hide-console-windows (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffa61f9df29f0ec2845ac6191bc7bcf26ddfd4901abd17d21359a4c5c4cd2a6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

A Critical Vulnerability in Openfire Admin Console Actively Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The vulnerability CVE-2023-32315 in Ignite Realtime Openfire, enabling unauthorized access to privileged pages. Attackers exploit this by bypassing authentication, prompting immediate updates for...

Thousands of Unpatched Openfire XMPP Servers Still Exposed to High-Severity Flaw

Thousands of Openfire XMPP servers are unpatched against a recently disclosed high-severity flaw and are susceptible to a new exploit, according to a new report from VulnCheck. Tracked as CVE-2023-32315 CVSS score: 7.5, the vulnerability relates to a path traversal vulnerability in Openfire's...

Ignite Realtime Openfire Path Traversal Vulnerability

Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users...

The vulnerability of the administration console of a cross-platform real-time collaboration server like Openfire, related to the possibility of bypassing the path, allows attackers to increase their privileges.

The vulnerability of the administration console of a cross-platform real-time collaboration server like Openfire is related to the possibility of bypassing the authentication process. Exploiting this vulnerability allows an attacker who operates remotely to enhance their privileges...

CVE-2023-24514

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24514

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...

Cross site scripting

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24514 Stored Cross Site Scripting Vulnerability in Visual Console Module

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...