Code injection

Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...

GHSA-4GCF-5M39-98MC Woodpecker does not validate webhook before changing any data

Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...

Woodpecker does not validate webhook before changing any data

Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...

CVE-2023-40034 Repositoty takeover in woodpecker-ci

Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...

CVE-2023-37857

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...

First Depositor Attack is possible by front-running mip00 script execution

Lines of code Vulnerability details Overview The First Depositor Attack Within the context of Compound v2, a First Depositor Attack occurs when an attacker becomes the inaugural minter of a cToken. This enables them to establish the first exchange rate between the underlying asset and the cToken...

TeleAdapt RoomCast TA-2400 Trust Management Issues Vulnerability

The TeleAdapt RoomCast TA-2400 is an all-in-one, self-contained, top-of-the-line content streaming box for guest rooms from TeleAdapt UK. A trust management issue vulnerability exists in TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1, which stems from the presence of an issue with the use of...

CVE-2023-37976

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

CVE-2023-37976

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

CVE-2023-37976

CVE-2023-37976: Unauthenticated Reflected Cross-Site Scripting in WordPress Radio Forge Muses Player with Skins plugin (versions <= 2.5). The connected sources confirm the vulnerability is XSS with unauthenticated exposure and no publicly documented fix/version yet. Wordfence entries list the ...

CVE-2023-37976 WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

WordPress Plugin Radio Forge Muses Player with Skins 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Google Nest 授权问题漏洞

Google Nest is a smart home product by Google, an American company. Google Nest has a security vulnerability. The vulnerability allows unauthenticated nodes to forge radio frames using "Key ID Mode 2", a special mode that uses a static encryption key to bypass security checks, allowing arbitrary ...

CVE-2023-37291

Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data. This issue affects Vitals ESP: from 3.0.8 through...

WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Software Radio Forge Muses Player with Skins Type Plugin Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37976 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 433315cbcfd4 Credits L...

WordPress Plugin NotificationX 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

Certsync - Dump NTDS With Golden Certificates And UnPAC The Hash

certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate for ever...

Design/Logic Flaw

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...

pigeonforgejellystone.com Cross Site Scripting vulnerability OBB-3365657

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...