18966 matches found
Dell Storage Resource Manager 资源管理错误漏洞
Dell Storage Resource Manager is a software for managing storage resources from Dell USA. A resource management error vulnerability exists in Dell Storage Resource Manager version 4.9.0.0 and earlier, which stems from the presence of session fixation and can be exploited by an unauthenticated...
Xibo 安全漏洞
Xibo is a content management system open source by Xibo Digital Signage. A security vulnerability exists in Xibo CMS that stems from the ability to perform session hijacking via cross-site scripting XSS attacks in the header and session grid...
Xibo 安全漏洞
Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo that originates from a session hijacking via token exposure on a session page...
PT-2024-22676 · Xibo · Xibo
Name of the Vulnerable Software and Affected Versions: Xibo versions prior to 3.3.10 Xibo versions prior to 4.0.9 Xibo version 1.8 Xibo version 2.3 Description: Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected...
PT-2024-22677 · Xibo · Xibo
Name of the Vulnerable Software and Affected Versions: Xibo versions prior to 3.3.10 Xibo versions prior to 4.0.9 Xibo version 1.8 Xibo version 2.3 Description: Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens...
Ubuntu: Security Advisory (USN-6722-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2024-3484 · Php +10 · Php +10
Name of the Vulnerable Software and Affected Versions: PHP affected versions not specified Description: The issue is related to the incorrect handling of cookies by PHP applications, allowing network and same-site attackers to set a standard insecure cookie in the victim's browser, which is then...
From PDFs to Payload: Bogus Adobe Acrobat Reader Installers Distribute Byakugan Malware
Bogus installers for Adobe Acrobat Reader are being used to distribute a new multi-functional malware dubbed Byakugan. The starting point of the attack is a PDF file written in Portuguese that, when opened, shows a blurred image and asks the victim to click on a link to download the Reader...
CVE-2024-31204
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...
CVE-2024-30264
Typebot is an open-source chatbot builder. A reflected cross-site scripting XSS in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the redirectPath parameter from the URL. If a user clicks on a link where the...
CVE-2024-31204 mailcow Cross-site Scripting Vulnerability via Exception Handler
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...
CVE-2024-30264 typebot.io: `GHSL-2024-040`
Typebot is an open-source chatbot builder. A reflected cross-site scripting XSS in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the redirectPath parameter from the URL. If a user clicks on a link where the...
Google Chrome Beta Tests New DBSC Protection Against Cookie-Stealing Attacks
Google on Tuesday said it's piloting a new feature in Chrome called Device Bound Session Credentials DBSC to help protect users against session cookie theft by malware. The prototype – currently tested against "some" Google Account users running Chrome Beta – is built with an aim to make it an op...
WordPress Alemha Watermarker 1.3.1 Cross Site Scripting
Exploit Title: Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting XSS Date: 22 March 2024 Exploit Author: Erdemstar Vendor: https://wordpress.com/ Version: 1.3.1 Proof Of Concept: 1. Click Add New Watermark and enter the XSS payload into the Watermark Text. 2. Stored XSS will...
SUPERAntiSpyware Professional X 10.0.1264 DLL Hijacking / Privilege Escalation
Title: SUPERAntiSpyware Professional X Version =10.0.1264 "version.dll" Local Privilege Escalation Date: 03.04.2024 Author: M. Akil Gündoğan Vendor Homepage: https://superantispyware.com/ Version: 10.0.1262 and lastest version 10.0.1264 Tested on: Windows 10 Professional x64 PoC Video:...
ROS-20240402-19
A vulnerability in the VMware Tools suite for Windows operating systems is related to a flaw in the authorization procedure. of authorization. Exploitation of the vulnerability could allow an attacker acting remotely to elevate their privileges VMware Tools s utility suite vulnerability is relate...
China-linked Hackers Deploy New 'UNAPIMON' Malware for Stealthy Operations
A threat activity cluster tracked as Earth Freybug has been observed using a new malware called UNAPIMON to fly under the radar. "Earth Freybug is a cyberthreat group that has been active since at least 2012 that focuses on espionage and financially motivated activities," Trend Micro security...
Earth Freybug Uses UNAPIMON for Unhooking Critical APIs
This article provides an in-depth look into two techniques used by Earth Freybug actors: dynamic-link library DLL hijacking and application programming interface API unhooking to prevent child processes from being monitored via a new malware we’ve discovered and dubbed UNAPIMON...
Intel PowerGadget 3.6 Local Privilege Escalation Vulnerability
Vulnerability summary: Local Privilege Escalation from regular user to SYSTEM, via conhost.exe hijacking triggered by MSI installer in repair mode Affected Products: Intel PowerGadget Affected Versions: tested on PowerGadget3.6.msi a3834b2559c18e6797ba945d685bf174, file signed on Monday, Februa...
The vulnerability of the server software HAProxy, related to the rerouting of empty Content-Length headers, allows a hacker to perform a “HTTP request hijacking” attack.
The vulnerability of the server software HAProxy relates to the rerouting of empty headers called Content-Length. Exploiting this vulnerability allows a malicious actor to carry out an “HTTP request hijacking” attack...