3236 matches found
PT-2023-3299 · Microsoft +7 · Net +9
Name of the Vulnerable Software and Affected Versions: .NET, .NET Framework, and Visual Studio affected versions not specified Description: The issue is related to insufficient access control in Microsoft's .NET Framework, .NET, and Visual Studio, allowing an attacker to elevate their privileges...
golang: path/filepath: path-filepath filepath.Clean path traversal
A flaw was found in Go, where it could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests by the filepath.Clean on Windows package. This flaw allows an attacker to send a specially-crafted URL request containing "dot dot" sequences /../ t...
Cyclops Ransomware Gang Offers Go-Based Info Stealer to Cybercriminals
Threat actors associated with the Cyclops ransomware have been observed offering an information stealer malware that's designed to capture sensitive data from infected hosts. "The threat actor behind this ransomware-as-a-service promotes its offering on forums," Uptycs said in a new report. "Ther...
CVE-2023-34407
OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL...
PT-2023-24859 · Unknown · Harbinger Offline Player
Name of the Vulnerable Software and Affected Versions: Harbinger Offline Player version 4.0.6.0.2 Description: The issue allows directory traversal as LocalSystem via .. in a URL. This can be exploited in OfflinePlayerService.exe. Recommendations: For Harbinger Offline Player version 4.0.6.0.2,...
CVE-2022-46856
Cross-Site Request Forgery CSRF vulnerability in ORION Woocommerce Products Designer plugin = 4.3.3 versions...
CVE-2023-33248
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...
CVE-2023-33248
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...
CVE-2023-33248
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...
Design/Logic Flaw
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...
springframework: Authorization Bypass in RegexRequestMatcher
A flaw was found in Spring Security. When using RegexRequestMatcher, an easy misconfiguration can bypass some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...
CVE-2023-33248
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...
CVE-2023-33248
CVE-2023-33248 affects Amazon Alexa on Echo Dot 2nd/3rd gen with firmware version 8960323972. The flaw allows attackers to deliver security-relevant commands via ultrasonic audio signals in the 16–22 kHz range, which are often outside adult hearing. Impacted component is the Alexa software’s comm...
CVE-2023-33248
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...
golang: net/url: JoinPath does not strip relative path components in all circumstances
A flaw was found in the golang package. The JoinPath doesn't remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack...
golang: path/filepath: path-filepath filepath.Clean path traversal
A flaw was found in Go, where it could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests by the filepath.Clean on Windows package. This flaw allows an attacker to send a specially-crafted URL request containing "dot dot" sequences /../ t...
CVE-2023-22684
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...
codehaus-plexus: Directory Traversal
A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...
PT-2023-7448 · Opc Foundation · Opc Foundation Ua .Net Standard
Name of the Vulnerable Software and Affected Versions: OPC Foundation UA .NET Standard affected versions not specified Description: This issue allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. The specific flaw exists...