6274 matches found
WordPress Forminator Plugin <= 1.22.1 is vulnerable to Broken Access Control
Software Forminator Type Plugin Vulnerable versions = 1.22.1 Fixed in 1.23.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 5.4 Developer WPMU DEV PSID 38229dd9fbd0 Credits Unknown Required privilege Subscriber...
WordPress Hummingbird Plugin < 3.4.2 is vulnerable to Path Traversal
Software Hummingbird Type Plugin Vulnerable versions 3.4.2 Fixed in 3.4.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Path Traversal CVE CVE-2023-1478 Patch priority High CVSS severity High 8.6 Developer WPMU DEV PSID 237afa7a6db1 Credits Karol Mazurek AFINE Required privilege...
Snapchat: internal dev tokens disclosure
Sensitive internal development information was inadvertently disclosed in the commits history of the open-source project Keydb, which was made public by Snapchat. This included a Personal Access Token PAT used for GitHub authentication, which could have been exploited by malicious actors...
Iran-Based Hackers Caught Carrying Out Destructive Attacks Under Ransomware Guise
The Iranian nation-state group known as MuddyWater has been observed carrying out destructive attacks on hybrid environments under the guise of a ransomware operation. That's according to new findings from the Microsoft Threat Intelligence team, which discovered the threat actor targeting both...
Iran-Based Hackers Caught Carrying Out Destructive Attacks Under Ransomware Guise
The Iranian nation-state group known as MuddyWater has been observed carrying out destructive attacks on hybrid environments under the guise of a ransomware operation. That's according to new findings from the Microsoft Threat Intelligence team, which discovered the threat actor targeting both...
MERCURY and DEV-1084: Destructive attack on hybrid environment
April 2023 update – Microsoft Threat Intelligence has shifted to a new threat actor naming taxonomy aligned around the theme of weather. MERCURY is now tracked as Mango Sandstorm and DEV-1084 is now tracked as Storm-1084. To learn more about the new taxonomy represents the origin, unique traits,...
PT-2025-41071
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to SCSI operations with the hisi sas driver. Specifically, a NULL pointer dereference can occur when freeing slots, potentially triggered during...
Multiple XSS in Create/Update Funtion Version 1.4.3 and 1.5.0-dev.2
Description Stored XSS on create/update service, categories, settings. I was test on 1.4.3 demo site and 1.5.0-dev2 Proof of Concept Install\ I install from develope branch. When finish install footer display version v1.5.0-dev.2\ The time I run and commit below on image is the latest\ \ webUI\ ...
Stack overflow
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...
CVE-2021-3923
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...
CVE-2021-3923: Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...
@web-desktop-environment/development-edition-server (>=2.0.0-2, <=2.0.0-alpha.11), @web-desktop-environment/pack-dev (>=2.0.0-1, <=2.0.0-alpha.11) potentially affected by CVE-2023-26114 via code-server (>=4.4.0, <=4.5.1)
code-server NPM version =4.4.0, =2.0.0-2, =2.0.0-1, =2.0.0-alpha.11 Source cves: CVE-2023-26114 Source advisory: GHSA-FRJG-G767-7363...
@web-desktop-environment/development-edition-server (>=0.0.4, <=2.0.0-alpha.11), @web-desktop-environment/pack-dev (>=1.0.1-alpha.1, <=2.0.0-alpha.11) potentially affected by CVE-2023-26114 via code-server (>=3.9.2, <=4.5.1)
code-server NPM version =3.9.2, =0.0.4, =1.0.1-alpha.1, =2.0.0-alpha.11 Source cves: CVE-2023-26114 Source advisory: MEND:CVE-2023-26114...
dev-smt.netstream.ch Cross Site Scripting vulnerability OBB-3229774
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Debian dla-3355 : libxapian-dev - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3355 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3355-1 [email protected] https://www.debian.org/lts/security/...
Heap overflow
A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gfm2tsprocesssdt of the file mediatools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been...
GPAC 资源管理错误漏洞
GPAC is an open source multimedia framework. A resource management error vulnerability exists in GPAC version 2.3-DEV-rev35-gbbca86917-master, which stems from the presence of an unknown function in the file filters/loadtext.c, resulting in a buffer overflow...
PT-2023-9308 · Gpac +1 · Gpac +1
Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev35-gbbca86917-master Description: A vulnerability has been found in the function gf av1 reset state of the file media tools/av parsers.c, which leads to double free. The manipulation can be launched on the local host...
CVE-2021-36821
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11...