17052 matches found
Evasive QBot Malware Leverages Short-lived Residential IPs for Dynamic Attacks
An analysis of the "evasive and tenacious" malware known as QBot has revealed that 25% of its command-and-control C2 servers are merely active for a single day. What's more, 50% of the servers don't remain active for more than a week, indicating the use of an adaptable and dynamic C2...
CLSA-2023-1685629665 dhcp: Fix of 2 CVEs
CVE-2022-2928: option refcount overflow when leasequery is enabled leading to dhcpd abort - CVE-2022-2929: DHCP memory leak - Backported tests from upstream, for this and other CVEs...
CVE-2023-3027
The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values instead of the policy apply a static manifest on a managed cluster of taking advantage of cluster scoped access in a created policy. This feature...
Vulnerability fixed in Arista series 7000 switches
Arista has fixed a vulnerability in the EOS software of several Series 7000 switches. A malicious party can exploit abuse the vulnerability to use a manipulated DHCP packet to crash and restart the DHCP relay service to crash and restart, thus creating a partial Denial-of-Service can occur. Arist...
CVE-2023-24510
On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...
CVE-2023-28353
An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to...
CVE-2023-28080
PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user non-admin can exploit these issues to potentially escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM...
Ubuntu 20.04 ESM : Nanopb vulnerabilities (USN-6121-1)
The remote Ubuntu 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6121-1 advisory. It was discovered that Nanopb incorrectly handled certain decode messages. An attacker could possibly use this cause a denial of service or expose...
PrinterLogic Build 1.0.757 XSS / SQL Injection / Authentication Bypass
PrinterLogic SaaS, multiple vulnerabilities =========================================================== PrinterLogic's Enterprise Print Management software allows IT professionals to simplify printer driver management and empower end users. -- https://www.printerlogic.com/ Background...
Linux / Unix Network Config Enumeration
Enumerates Linux / Unix network configuration details. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid176476; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/07/29"; scriptnameenglish:"Linux / Unix Network Config Enumeration";...
WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)
Software Dynamic QR Code Generator Type Plugin Vulnerable versions = 0.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34022 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 663371fa0bd1 Credits thiennv...
The vulnerability of the Microsoft .NET software platform, related to incorrect handling of the path to DLL libraries, allows a hacker to execute arbitrary code.
The vulnerability of the Microsoft .NET software platform is related to incorrect handling of the path to the DLL libraries. Exploiting these vulnerabilities can allow an attacker to execute arbitrary code...
CVE-2023-33212
Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...
CVE-2023-33212
CVE-2023-33212 : Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin with version <= 3.0.6 contains a CSRF vulnerability (unauthenticated). The issue is mitigated by upgrading to version 3.0.7 or later. Multiple sources confirm the vulnerability details and patch, e.g., PatchStack n...
PT-2023-24223 · Crocoblock · Crocoblock Jetformbuilder
Name of the Vulnerable Software and Affected Versions: Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin versions 3.0.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...
WordPress plugin JetFormBuilder — Dynamic Blocks Form Builder 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
Missing authorization in Liferay portal
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL...
GHSA-W6F8-MXF5-4VF8 Missing authorization in Liferay portal
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL...
CVE-2023-33948
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL...