GHSA-4H2Q-84W7-4MHX nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS)

nilsteampassnet/teampass prior to 3.0.3 is vulnerable to stored cross-site scripting XSS in the description parameter of a folder...

PT-2023-17414 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.3 Description: The issue is related to stored Cross-site Scripting XSS in the GitHub repository nilsteampassnet/teampass. Specifically, the description parameter of a folder is vulnerable. This allows an attacke...

OPENSUSE-SU-2023:0090-1 Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues: nextcloud-desktop was updated to 3.8.0: - Resize WebView widget once the loginpage rendered - Feature/secure file drop - Check German translation for wrong wording - L10n: Correct word - Fix displaying of file details button for local...

CVE-2023-29478

BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution...

CVE-2023-29478: Improper Limitation of a Pathname to a Restricted Directory

BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution...

Code injection

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer MSI of WARP Client for Windows = 2022.12.582.0 allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As...

CVE-2023-0652 Local Privilege Escalation in Cloudflare WARP Installer (Windows)

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer MSI of WARP Client for Windows = 2022.12.582.0 allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As...

CVE-2023-0652

CVE-2023-0652 is a Local Privilege Escalation in Cloudflare WARP Installer (Windows). The issue stems from a hardlink created in the ProgramData folder during the repair process, where the MSI-based installer could forge the hardlink’s destination, enabling privilege escalation and overwriting SY...

PT-2023-16429 · Cloudflare · Warp Client For Windows

Name of the Vulnerable Software and Affected Versions: WARP Client for Windows versions = 2022.12.582.0 WARP Client for Windows versions up to 2022.5.309.0 Description: The issue allows a malicious attacker to escalate privileges and overwrite SYSTEM protected files by forging the destination of ...

Stored XSS on function item with folder

Description Create two account and allow same folder. \ one account create a new item in folder. in description parameter select code view and paste payload XSS.\ Save and click on item will show a alert XSS. Other account login and view folder click on item and see a alert XSS Proof of Concept g...

CVE-2023-28998

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new...

DEBIAN-CVE-2023-28998

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new...

CVE-2023-28999

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files,...

CVE-2023-28999

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files,...

Desktop clients misbehaves with end-to-end encryption when the server returns an empty list of metadata keys

None...

NextCloud security vulnerabilities

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Desktop Client version 3.0.0 through versions prior to 3.6.5. An attacker can exploit the vulnerability to gai...

CVE-2023-28998: Missing Cryptographic Step

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new...

PT-2023-12912

Name of the Vulnerable Software and Affected Versions Progress Ipswitch WS FTP Server version 8.6.0 Description Reflected XSS exists due to improper handling of user-provided input, allowing execution of malicious code and commands on the client. This can be achieved by inputting malicious payloa...

Apple iOS and iPadOS security vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and iPadOS, which originates from a file from the iCloud Shared by Me folder...

macOS 13.x < 13.3 Multiple Vulnerabilities (HT213670)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.3. It is, therefore, affected by multiple vulnerabilities: - Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial ...