1142 matches found
Inside the Booming ‘AI Pimping’ Industry
AI-generated influencers based on stolen images of real-life adult content creators are flooding social media...
GHSA-F632-9449-3J4W Apache Tomcat - XSS in generated JSPs
Description: The fix for improvement 69333 caused pooled JSP tags not to be released after use which in turn could cause output of some tags not to escaped as expected. This unescaped output could lead to XSS. Versions Affected: - Apache Tomcat 11.0.0 - Apache Tomcat 10.1.31 - Apache Tomcat 9.0.9...
CVE-2024-10146
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins...
Authentication Method Confusion
CodeChecker is vulnerable to Authentication Method Confusion. The vulnerability is due to insufficient account security, where the weakly generated root user account cannot be disabled, allowing attackers to exploit it through an external authentication service...
Cross-site Scripting (XSS)
baserCMS is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input validation in the blog post feature, allowing user-generated content to include malicious scripts...
Authentication Bypass by Primary Weakness
Overview codechecker is an analyzer tooling, defect database and viewer extension Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the form of giving the unremovable auto-generated root user superuser privileges by default. An attacker in possession...
CVE-2024-10082
Summary (CVE-2024-10082) CodeChecker (Clang Static Analyzer/Tidy tooling) up to version 6.24.1 contains an authentication flaw: an auto-generated built-in root user with superuser permissions that cannot be disabled. An attacker who can create an account on an enabled external authentication serv...
GO-2024-3234 Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server...
DEBIAN-CVE-2024-7883
When using Arm Cortex-M Security Extensions CMSE, Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state...
PT-2024-38657
Name of the Vulnerable Software and Affected Versions Arm Cortex-M Security Extensions CMSE affected versions not specified Description The issue allows Secure stack contents to be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that retur...
Mattermost Server vulnerable to application crash from attacker-generated large response
Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1 and 9.5.x = 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by...
Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document. This vulnerability is due ...
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
...
Exploit for Code Injection in Ispconfig
CVE-2023-46818 exploit This is a python version of the origin...
A (Beta) Audio Roundup of September’s WordPress Vulnerabilities
For those of you that want to stay abreast of the newest vulnerabilities in the WP ecosystem, but like to multitask, here's an audio roundup of the vulnerabilities we published in the month of September. This is something new I'm trying. The conversation is AI generated by Google's NotebookLM...
A week in security (September 16 – September 22)
Last week on Malwarebytes Labs: "Simply staggering" surveillance conducted by social media and streaming services, FTC finds Tor anonymity compromised by law enforcement. Is it still safe to use? Walmart customers scammed via fake shopping lists, threatened with arrest Snapchat wants to put your...
Snapchat wants to put your AI-generated face in its ads
Snapchat is reserving the right to use your selfie images to power Cameos, Generative AI, and other experiences on Snapchat, including ads, according to our friends at 404 Media, The Snapchat Support page about its My Selfie feature says: “You’ll take selfies with your Snap camera or select image...
Cross Site Scripting(XSS)
MindsDB is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper sanitization or validation of user-generated content within the MindsDB platform. It allows an attacker to execute arbitrary JavaScript code in a user's browser by injecting it into the web UI throug...
