phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes

Summary The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. Details The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality...

Preventing Data Loss: Backup and Recovery Strategies for Exchange Server Administrators

In the current digital landscape, data has emerged as a crucial asset for organizations, akin to currency. It's the lifeblood of any organization in today's interconnected and digital world. Thus, safeguarding the data is of paramount importance. Its importance is magnified in on-premises Exchang...

Trend Micro Apex One Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Stack overflow

Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage...

Teleport: Improper session management - Failure to invalidate old session after password change

Failure to Invalidate Session on Password Change Failure to invalidate a session after a password change is a vulnerability which allows an attacker to maintain access on a service. Most users have the expectation that when they reset their password, no one else can access their account. When...

X.Org Server Damage Object Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Damage...

Buffer overflow

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity...

Spanish Police Nab Venezuelan Leader of Kelvin Security Hacker Group

By Waqas The arrested Venezuelan individual now faces charges including membership in a criminal organization, disclosure of secrets, computer damage, and money laundering. This is a post from HackRead.com Read the original post: Spanish Police Nab Venezuelan Leader of Kelvin Security Hacker Grou...

Reentrancy issue. User can easily mint more than allowed presale, bypassing merkle root limit

Lines of code Vulnerability details Impact Lack of reentrancy protection and code not follow Checks, Effects, Interactions pattern guideline. Here are the Effects stuff happen after Interactions affected by reentrancy: tokensMintedAllowlistAddress: tracking presale minted NFT per address...

Open redirect

Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites,...

CVE-2023-49281 Open Redirect in Login Function of Calendarinho

Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites,...

CVE-2023-49281 Open Redirect in Login Function of Calendarinho

Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites,...

CVE-2023-49281

CVE-2023-49281 affects the Calendarinho open-source calendaring application, with an Open Redirect in the login path caused by insufficient validation. Versions prior to commit 15b2393 are vulnerable, enabling phishing risks through redirection to external URLs. The issue has been patched in comm...

SUSE-SU-2023:4338-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2023-5574: Fixed a privilege escalation issue that could be triggered via the Damage extension protocol bsc1216261. - CVE-2023-5380: Fixed a memory safety issue that could be triggered when using multiple protocol screens bsc121613...

Massive MOVEit Hack: 630K+ US Defense Officials’ Emails Breached

By Deeba Ahmed The damage from the MOVEit hack is slowly emerging. This is a post from HackRead.com Read the original post: Massive MOVEit Hack: 630K+ US Defense Officials Emails Breached...

SUSE-SU-2023:4293-1 Security update for xwayland

This update for xwayland fixes the following issues: - CVE-2023-5574: Fixed a privilege escalation issue that could be triggered via the Damage extension protocol bsc1216261. - CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR protocols bsc1216135...

SUSE-SU-2023:4292-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2023-5574: Fixed a privilege escalation issue that could be triggered via the Damage extension protocol bsc1216261. - CVE-2023-5380: Fixed a memory safety issue that could be triggered when using multiple protocol screens bsc121613...

SUSE-SU-2023:4269-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2023-5574: Fixed a privilege escalation issue that could be triggered via the Damage extension protocol bsc1216261. - CVE-2023-5380: Fixed a memory safety issue that could be triggered when using multiple protocol screens bsc121613...

PortSwigger Web Security: Title: Deceptive Manipulation of HTTP to HTTPS with VPN in Burp Suite

Vulnerability description not provided...

Nextcloud: Delete external storage of any user

An external storage vulnerability was discovered that allowed standard users to delete external storage resources from any user account in the application. By modifying a system-generated ID, unauthorized users could remove externally linked storage without special privileges, potentially resulti...