PT-2023-27314 · WordPress · Media From Ftp

Name of the Vulnerable Software and Affected Versions: Media from FTP WordPress plugin versions prior to 11.17 Description: The issue arises from the Media from FTP WordPress plugin not properly limiting who can use the plugin. This may allow users with author+ privileges to move files around, su...

WordPress plugin Media from FTP security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-24397

creationtimestamp| type| source ---|---|--- 2023-08-30 20:12:35+00:00| seen| https://t.me/cibsecurity/69474...

CVE-2022-1601

creationtimestamp| type| source ---|---|--- 2023-08-30 18:12:29+00:00| seen| https://t.me/cibsecurity/69443...

CLSA-2023-1693417671 microcode_ctl: Fix of CVE-2022-40982

Update Intel CPU microcode to microcode-20230808 release addresses CVE-2022-40982: - Addition of 06-ba-02/0xe0 microcode in microcode.dat at revision 0x4119; - Addition of 06-ba-02/0xe0 microcode in microcode.dat at revision 0x4119; - Addition of 06-ba-03/0xe0 microcode in microcode.dat at...

PYSEC-2023-146

An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the frommathprompt and fromcoloredobjectprompt functions...

Gigabud RAT Android Banking Malware Targets Institutions Across Countries

Account holders of over numerous financial institutions in Thailand, Indonesia, Vietnam, the Philippines, and Peru are being targeted by an Android banking malware called Gigabud RAT. "One of Gigabud RAT's unique features is that it doesn't execute any malicious actions until the user is authoriz...

LangChain Injection Vulnerability

LangChain is used to build applications using LLM through composability. A security vulnerability exists in langchain version 0.0.194 and earlier versions, which results from arbitrary code execution via the frommathprompt and fromcoloredobjectprompt functions...

SUSE CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

UBUNTU-CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

PYSEC-2023-137

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

PT-2023-27176 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel version 1.4.3 Description: 1Panel is an open source Linux server operation and maintenance management panel. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested...

CVE-2023-36865

creationtimestamp| type| source ---|---|--- 2023-08-08 22:14:19+00:00| seen| https://t.me/cibsecurity/68024 2025-02-27 21:26:18+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5806...

PYSEC-2023-138

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

LangChain Code Injection Vulnerability

LangChain is used to build applications using LLM through composability. A code injection vulnerability exists in Harrison Chase langchain version v.0.0.194, which stems from an arbitrary code execution vulnerability in frommathpromptllm.run...

Mitsubishi Electric GOT2000 and GOT SIMPLE

1. EXECUTIVE SUMMARY ​CVSS v3 5.9 ​ATTENTION: Exploitable remotely ​Vendor: Mitsubishi Electric ​Equipment: GOT2000 Series and GOT SIMPLE Series ​Vulnerability: Predictable Exact Value from Previous Values 2. RISK EVALUATION ​Successful exploitation of this vulnerability could allow an attacker...

WordPress Media from FTP Plugin < 11.16 is vulnerable to Broken Access Control

Software Media from FTP Type Plugin Vulnerable versions 11.16 Fixed in 11.16 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 23159e872c33 Credits Marc-Alexandre Montpas Required privilege...

Arbitrary from in transferFrom

Lines of code Vulnerability details Impact function aaddress from, address to, uint256 amount public erc20.transferFromfrom, to, am; Alice approves this contract to spend her ERC20 tokens. Bob can call a and specify Alice's address as the from parameter in transferFrom, allowing him to transfer...

TokenManager.sendToken/callContractWithInterchainToken/transmitInterchainTransfer require re-entry protection

Lines of code Vulnerability details Impact Anyone can deploy a TokenManagerLockUnlock for the existing ERC20 via registerCanonicalToken, and deploy the corresponding token on a target chain via deployRemoteCanonicalToken. After the TokenManagers of the two chains are created, users can transfer...

GHSA-F9G6-FP84-FV92 impl `FromMdbValue` for bool is unsound

The implementation of FromMdbValue has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of...