CVE-2023-3612

The CVE-2023-3612 issue affects the Govee Home app, where unprotected access to the WebView component allows any app on the device to open WebView. A crafted URL can enable JavaScript execution in the WebView context or display phishing content to steal sensitive data. Documented impact includes ...

PT-2023-25434 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home app affected versions not specified Description: The Govee Home app has unprotected access to the WebView component, which can be opened by any app on the device. By sending a URL to a specially crafted site, an attacker can execut...

Govee Home Security Breach

Govee Home is a software application. Govee Home contains a security vulnerability that stems from the fact that the WebView component can be opened by any application on the device, and by sending the URL to a specially crafted website, an attacker can execute JavaScript in the WebView context o...

Zoo Management System SQL注入漏洞

Zoo Management System is a zoo management system. It provides an online and automated platform for zoo organizations to manage their daily records. Zoo Management System v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on th...

jeecg SQL注入漏洞

Jeecg-Boot is a low-code platform based on a code generator. A SQL injection vulnerability exists in Jeecg-Boot v3.5.3 and earlier versions, which stems from a lack of validation of externally entered SQL statements in the component /jeecg-boot/jmreport/show. An attacker can exploit this...

Improper Input Validation

trafficserver is vulnerable to Improper Input Validation. This vulnerability allows an attacker to bypass security restrictions by sending a specially crafted HTTP request to gain unauthorized access to a vulnerable Apache Traffic Server instance, which could allow them to steal data, modify...

CVE-2023-4528: Java Deserialization Vulnerability in JSCAPE MFT (Fixed)

In August 2023, Rapid7 discovered a Java deserialization vulnerability in Redwood Software’s JSCAPE MFT secure managed file transfer product. The vulnerability was later assigned CVE-2023-4528. It can be exploited by sending an XML-encoded Java object to the Manager Service port, which, by defaul...

New Variant of Chaes Malware ‘Chae$ 4’ Targeting Financial and Logistics Sectors

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new Chaes malware variant, "Chae$ 4," targeting logistics, finance, and prominent platforms has emerged with enhanced capabilities, including Python-based architecture and an expanded range of targeted...

New Python Variant of Chaes Malware Targets Banking and Logistics Industries

Banking and logistics industries are under the onslaught of a reworked variant of a malware called Chaes. "It has undergone major overhauls: from being rewritten entirely in Python, which resulted in lower detection rates by traditional defense systems, to a comprehensive redesign and an enhanced...

PT-2023-27153 · Unknown · Saasproject Booking Package

Name of the Vulnerable Software and Affected Versions: SAASPROJECT Booking Package plugin versions = 1.6.01 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-27197 · Blindside Networks · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: Blindside Networks BigBlueButton plugin versions = 3.0.0-beta.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-27323 · Pixelgrade · Pixtypes

Name of the Vulnerable Software and Affected Versions: Pixelgrade PixTypes plugin versions 1.4.15 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them t...

Malicious Package

Overview gunther is a malicious package. This package contains a malicious code that steals sensitive information from the host machine and sends it to a remote server. Remediation Avoid using all malicious instances of the gunther package. References - Phylum Blog Credit: Phylum Research Team...

Exploit for Improper Input Validation in Usememos Memos

CVE-2023-4698 Local File Inclusion LFI in usememos/memos...

PT-2023-26242 · WordPress · Dharmesh Patel Post List With Featured Image

Name of the Vulnerable Software and Affected Versions: Dharmesh Patel Post List With Featured Image plugin versions 1.2 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-20084 · WordPress · Mahlamusa Who Hit The Page – Hit Counter

Name of the Vulnerable Software and Affected Versions: Mahlamusa Who Hit The Page – Hit Counter plugin versions = 1.4.14.3 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-24719 · WordPress · Kaplugins Google Fonts For Wordpress

Name of the Vulnerable Software and Affected Versions: KAPlugins Google Fonts For WordPress plugin versions = 3.0.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

Moxa ioLogik 4000 Series Incorrect Authorization (CVE-2023-4227)

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...

CVE-2023-4227

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...

CVE-2023-4227

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...