VulnCheck KEV: CVE-2023-6634

The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to execute...

Improper Authorization

github.com/mattermost/mattermost is vulnerable to Improper Authorization. The vulnerability is caused due to improper permission validation while a user views archived public channels. One member of a team can view a channel of another team member via GET call to the /api/v4/teams//channels/delet...

PT-2024-4517 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 Description: The issue is related to the LearnPress plugin for WordPress, which is vulnerable to command injection in all versions up to, and including, 4.2.5.7. This...

minaliC 2.0.0 Denial Of Service

!/usr/bin/perl use Socket; Exploit Title: minaliC 2.0.0 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 03 january 2024 Vendor Homepage: http://minalic.sourceforge.net/ Download to demo: https://drive.google.com/file/d/1WoDbps6up2s5Xa40YXDSABRU9J17yRQd/view?usp=sharing...

CVE-2023-49794

KernelSU (Kernel-based root solution for Android) versions ≤ 0.7.1 contain a bypass in the kernel module’s apk-path logic. This allows a malicious apk named me.weishu.kernelsu, or one with a package name matching the official KernelSU Manager, to obtain root privileges on the device. Exploitation...

Mozilla: Use-after-free in PR_GetIdentitiesLayer

The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free condition affected TLS socket creation when under memory pressure...

Mozilla: Use-after-free in PR_GetIdentitiesLayer

The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free condition affected TLS socket creation when under memory pressure...

Mozilla: Use-after-free in PR_GetIdentitiesLayer

The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free condition affected TLS socket creation when under memory pressure...

Mozilla: Use-after-free in PR_GetIdentitiesLayer

The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free condition affected TLS socket creation when under memory pressure...

Malicious code in get_name_of_token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6b5dfc1df3f6f7257bc6a0ffb95fad3de4cde82911c81d5f21f1d8b70d05d6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the SNMP Notification Receiver function in the managers.php script of the Cacti network monitoring software allows a hacker to execute arbitrary SQL code.

The vulnerability of the SNMP Notification Receiver function in the managers.php script of the Cacti network monitoring software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code by sending...

CVE-2023-52286

Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/getdbinfo request, a related issue to CVE-2023-42387...

get-kratom.eu Improper Access Control vulnerability OBB-3824560

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-46989

SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getProducts function in the productlist.php file...

CVE-2023-50445

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the getsystemlog and...

GL.iNet Multiple Products Operating System Command Injection Vulnerability

GL.iNet MT1300 and others are products of China's Guanglian Zhitong GL.iNet.GL.iNet MT1300 is a router.GL.iNet MT300N-V2 is a mini router.GL.iNet AR750S is a router. Operating system command injection vulnerability exists in several GL.iNet products. The vulnerability stems from the getsystemlog...

PT-2024-1381

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.10 Description The issue is related to the smb2 get data area len function in the fs/smb/server/smb2misc.c file of the KSMBD file system in the Linux kernel. It is associated with an out-of-bounds access in t...

Cloud Japan - Failed to execute "Get-XdAuthentication" cmdlet

This issue happens within Citrix Cloud Japan environment. While executing "Get-XdAuthentication" cmdlet, "AuthenticationFailed" error is logged...

CVE-2023-38321

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service NULL pointer dereference, daemon crash, and Captive Portal outage via a GET request to /openndsauth/ that lacks a custom query string parameter and client-token...

CVE-2023-38321

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service NULL pointer dereference, daemon crash, and Captive Portal outage via a GET request to /openndsauth/ that lacks a custom query string parameter and client-token...