CVE-2023-40610 Apache Superset: Privilege escalation with default examples database

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

PT-2023-27540

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to but excluding 2.1.2 Description The issue is related to an improper authorization check, which could lead to possible privilege escalation. Using the default examples database connection, an attacker could access...

aporacle (>=0.0.126 <=0.0.143), enrichsdk (>=5.2.3 <=5.2.4) +11 more potentially affected by CVE-2023-6022 via prefect (>=2.0.0b16 <=2.16.3)

prefect PYPI version =2.0.0b16, =0.0.126, =5.2.3, =2.37.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =0.0.217, =0.15.3, =0.6.5, =0.1.1, =0.1.0a0, =0.7.0, =0.9.0 Source cves: CVE-2023-6022 Source advisory: OSV:GHSA-4HH5-2678-83FX...

RHEL 8 : qt5-qtsvg (RHSA-2023:6961)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6961 advisory. Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displayin...

VulnCheck KEV: CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

HBSQLI - Automated Tool For Testing Header Based Blind SQL Injection

HBSQLI is an automated command-line tool for performing Header Based Blind SQL injection attacks on web applications. It automates the process of detecting Header Based Blind SQL injection vulnerabilities, making it easier for security researchers , penetration testers & bug bounty hunters to tes...

Wallarm Webinar: NIST CSF 2.0, API Security, and CISO Imperatives

Last week, our good friend Raj Umadas, Director of Security at ActBlue, teamed up with our very own Tim Erlin, Head of Product, to talk about the newly proposed NIST Cybersecurity Framework CSF. It was a fantastic discussion covering the intent behind this update, the major changes from v1.1 to...

DRUPAL-CONTRIB-2023-041

This module makes PatternLab's custom Twig functions available to Drupal theming. The module's included examples don't sufficiently filter data. This vulnerability is mitigated by the fact that the included examples must have been copied to a site's theme...

cn.leancloud:filter-service-core (>=1.9 <=1.13), cn.leancloud:filter-service-metrics (>=1.9 <=1.13) +348 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (>=0.50.0 <=1.24.2)

com.linecorp.armeria:armeria MAVEN version =0.50.0, =1.9, =1.9, =0.3.1, =0.3.1, =0.3.1, =0.2.0, =0.13.0, =0.19.0, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.3 and more Source cves: CVE-2023-38493 Source advisory: OSV:GHSA-WVP2-9PPW-337J...

net.sansa-stack:sansa-examples-spark_2.12 (>=0.8.0-RC3 <=0.8.7), net.sansa-stack:sansa-inference-spark_2.12 (>=0.8.0-RC3 <=0.8.7) +4 more potentially affected by CVE-2023-22665 +1 more via org.apache.jena:jena (>=4.4.0 <=4.8.0)

org.apache.jena:jena MAVEN version =4.4.0, =0.8.0-RC3, =0.8.0-RC3, =0.8.0-RC3, =0.8.0-RC3, =0.8.0-RC3, =0.8.0-RC3, =0.8.7 Source cves: CVE-2023-22665, CVE-2023-32200 Source advisory: OSV:GHSA-J927-W6G7-7C7W...

Microsoft Windows PowerShell Remote Command Execution Exploit

This python script mints a .ps1 file with an exploitable semicolon condition that allows for command execution from Microsoft Windows PowerShell. This is an updated exploit to work with Python3. from base64 import b64encode import argparse,sys,os PSTrojanFile.py By hyp3rlinx c 2023 ApparitionSec...

openSUSE 15 Security Update : qt6-svg (openSUSE-SU-2023:0111-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0111-1 advisory. - In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont munitsPerEm initialization is mishandled...

com.adendamedia:cornucopia_2.11 (>=0.5.0 <=0.6.2), com.deciphernow:franz_2.11 (=1.0.0) +17 more potentially affected by CVE-2023-29471 via com.typesafe.akka:akka-stream-kafka_2.11 (>=0.11-M2 <=0.22)

com.typesafe.akka:akka-stream-kafka2.11 MAVEN version =0.11-M2, =0.5.0, =2.0.5, =0.1.3, =1.0.0, =1.2.0, =1.2.0, =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.4.9, =1.4.15 - de.nierbeck.floating.data:akka-ingest2.11 =0.1.1 - de.nierbeck.floating.data:akka-server2.11 =0.1.1 and more Source cves:...

Debian dla-3355 : libxapian-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3355 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3355-1 [email protected] https://www.debian.org/lts/security/...

Cross site scripting

A vulnerability was found in qt-users-jp silk 0.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file contents/root/examples/header.qml. The manipulation of the argument model.key/model.value leads to cross site scripting. The attack can be initiated...

SUSE CVE-2007-3383

Cross-site scripting XSS vulnerability in SendMailServlet in the examples web application examples/jsp/mail/sendmail.jsp in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, relat...

Exploit for Cleartext Storage of Sensitive Information in Keepass

PoCCVE-2023-24055 How to run ? Edit the $User var in th...

A Guide to Phishing Attacks

This is a good list of modern phishing techniques...

Exploit for Cleartext Storage of Sensitive Information in Keepass

CVE-2023-24055 POC and Scanner for CVE-2023-24055 Use at your...

Exploring the Vulnerabilities of Seaport: A Technical Analysis of a Fake Signature Attack on Non-Fungible Tokens

Lines of code Vulnerability details Impact This finding aims to provide a comprehensive analysis of the sc4m trend, which emerged in August 2022, and has since been a prevalent issue in the WEB3 space. Despite efforts to combat this phenomenon, bad actors continue to engage in illicit activities,...