1504 matches found
Metasploit Weekly Wrap-Up
Improved Ticket Forging Metasploit’s admin/kerberos/forgeticket module has been updated to work with Server 2022. In Windows Server 2022, Microsoft started requiring additional new PAC elements to be present - the PAC requestor and PAC attributes. The newly forged tickets will have the necessary...
CVE-2023-20238
A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...
CVE-2023-20238
A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...
CVE-2023-41627
O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...
PYSEC-2023-164
borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an...
forge-et-fonderie.com Cross Site Scripting vulnerability OBB-3602846
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Code injection
Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...
GHSA-4GCF-5M39-98MC Woodpecker does not validate webhook before changing any data
Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...
Woodpecker does not validate webhook before changing any data
Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...
CVE-2023-40034 Repositoty takeover in woodpecker-ci
Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...
CVE-2023-37857
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...
First Depositor Attack is possible by front-running mip00 script execution
Lines of code Vulnerability details Overview The First Depositor Attack Within the context of Compound v2, a First Depositor Attack occurs when an attacker becomes the inaugural minter of a cToken. This enables them to establish the first exchange rate between the underlying asset and the cToken...
TeleAdapt RoomCast TA-2400 Trust Management Issues Vulnerability
The TeleAdapt RoomCast TA-2400 is an all-in-one, self-contained, top-of-the-line content streaming box for guest rooms from TeleAdapt UK. A trust management issue vulnerability exists in TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1, which stems from the presence of an issue with the use of...
CVE-2023-37976
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
CVE-2023-37976
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
CVE-2023-37976 WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...
CVE-2023-37976
CVE-2023-37976: Unauthenticated Reflected Cross-Site Scripting in WordPress Radio Forge Muses Player with Skins plugin (versions <= 2.5). The connected sources confirm the vulnerability is XSS with unauthenticated exposure and no publicly documented fix/version yet. Wordfence entries list the ...
WordPress Plugin Radio Forge Muses Player with Skins 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-26223
Name of the Vulnerable Software and Affected Versions Radio Forge Muses Player with Skins plugin versions = 2.5 Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website...