18944 matches found
Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse
The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...
CVE-2023-26248
The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...
CVE-2023-26248
The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...
PT-2024-12089 · Ipfs +1 · Ipfs +1
Name of the Vulnerable Software and Affected Versions: go-libp2p-kad-dht versions 0.20.0 and earlier IPFS versions 0.18.1 and earlier Description: The issue allows an attacker to censor content in the InterPlanetary File System IPFS by exploiting the Kademlia DHT. This is done by generating many...
Cross-site Scripting (XSS)
Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Edit Email Form Settings feature. An attacker can manipulate the web page content or hijack user sessions. Details Cross-site...
Apache Syncope: Stored XSS in Console and Enduser
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser whe...
GHSA-JMRF-85G8-X8XV Apache Syncope: Stored XSS in Console and Enduser
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser whe...
CVE-2024-45031
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser whe...
CVE-2024-45031
Apache Syncope is affected by a Stored XSS vulnerability (CVE-2024-45031) due to incomplete HTML sanitization when editing objects in the Syncope Console and Enduser interfaces. This can allow injection of XSS payloads that trigger for other users during normal usage and could lead to session hij...
CVE-2024-45031 Apache Syncope: Stored XSS in Console and Enduser
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser whe...
CVE-2024-45031 Apache Syncope: Stored XSS in Console and Enduser
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser whe...
PT-2024-31384
Name of the Vulnerable Software and Affected Versions: Syncope versions prior to 3.0.9 Description: The issue allows an attacker to bypass HTML sanitization by using incomplete HTML tags when editing objects in the Syncope Console. This enables the injection of stored XSS payloads, which can...
Open Redirect
org.keycloak, keycloak-services is vulnerable vulnerable to Open Redirect. The vulnerability is due to a misconfiguration flaw in the validation of redirect URIs. An attacker can redirect users to an arbitrary URL and potentially expose sensitive information such as authorization codes, leading t...
Chinese Nation-State Hackers APT41 Hit Gambling Sector for Financial Gain
The prolific Chinese nation-state actor known as APT41 aka Brass Typhoon, Earth Baku, Wicked Panda, or Winnti has been attributed to a sophisticated cyber attack targeting the gambling and gaming industry. "Over a period of at least six months, the attackers stealthily gathered valuable informati...
Adobe Creative Cloud < 4.8.0.410 Privilege Escalation (APSB19-11)
The version of Adobe Creative Cloud installed on the remote Windows host is prior to 4.8.0.410. It is, therefore, affected by a vulnerability as referenced in the APSB19-11 advisory. - Creative Cloud Desktop Application installer versions 4.7.0.400 and earlier have an insecure library loading dll...
Adobe Creative Cloud < 4.5.5.342 Privilege Escalation (APSB18-20)
The version of Adobe Creative Cloud installed on the remote Windows host is prior to 4.5.5.342. It is, therefore, affected by a vulnerability as referenced in the APSB18-20 advisory. - Adobe Creative Cloud Desktop Application before 4.5.5.342 installer has an insecure library loading dll hijackin...
Adobe Character Animator 2.0.0 < 2.1.1 Arbitrary code execution (APSB19-32)
The version of Adobe Character Animator installed on the remote Windows host is prior to 2.1.1. It is, therefore, affected by a vulnerability as referenced in the APSB19-32 advisory. - Adobe Character Animator versions 2.1 and earlier have an insecure library loading dll hijacking vulnerability...
Adobe Premiere Pro < 13.1.3 Arbitrary code execution (APSB19-33)
The version of Adobe Premiere Pro installed on the remote Windows host is prior to 13.1.3. It is, therefore, affected by a vulnerability as referenced in the APSB19-33 advisory. - Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading dll hijacking vulnerability...
Adobe Connect <= 9.7.5 Multiple Vulnerabilities (APSB18-22)
The version of Adobe Connect installed on the remote host is prior to 9.8.1. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb18-22 advisory. - Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lea...