CVE-2023-37849

A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as PANDAVPN.exe...

BD Alaris System with Guardrails Suite MX 跨站脚本漏洞

The BD Alaris System with Guardrails Suite MX is a medical device from BD Medical BD, Inc. A security vulnerability exists in the BD Alaris System with Guardrails Suite MX, which originates from a malicious file that could be uploaded to the System Manager user import function, which could lead t...

PT-2023-26144 · Panda Security · Panda Security Vpn

Name of the Vulnerable Software and Affected Versions: Panda Security VPN for Windows versions prior to 15.14.8 Description: A DLL hijacking issue allows attackers to execute arbitrary code by placing a crafted DLL file in the same directory as the executable. Recommendations: For versions prior ...

Session is still valid after changing password

Description The application does not delete the old login session on the server side after changing the password. This poses a risk when a user uses a public computer and an attacker captures the login session. Even if the user has changed the password, the login session is still taken over by th...

CVE-2023-36917

SAP BusinessObjects Business Intelligence Platform versions 420 and 430 are affected by an authentication bypass where an attacker who hijacks a user session can brute-force the victim’s old password due to an unrestricted rate limit on the password-change function. The attack, as described in th...

SAP BusinessObjects Business Intelligence Platform 安全漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2023-2312)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux rootkits explained – Part 1: Dynamic linker hijacking

Dynamic linker hijacking via LDPRELOAD is a Linux rootkit technique utilized by different threat actors in the wild. In part one of this series on Linux rootkits, we discuss this threat and explain how to detect it...

Fake reviewers face big fines

The FTC is cracking down on fake reviews. Under the new proposed rules, organisations involved in the buying, selling, and manipulation of reviews could be very much out of pocket. Every time a consumer sees a fake review, it will carry a fine of "up to $50,000" per viewing. From the FTC release:...

Tiva Events Calender v1.4 - Cross Site Scripting Vulnerability

Document Title: =============== Tiva Events Calender v1.4 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2276 Release Date: ============= 2023-07-04 Vulnerability Laboratory ID VL-ID:...

Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities

Document Title: =============== Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2278 Release Date: ============= 2023-07-03 Vulnerability Laboratory ID VL-ID: ==================================...

Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities

Document Title: =============== Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2317 Release Date: ============= 2023-07-03 Vulnerability Laboratory ID VL-ID:...

Boom CMS v8.0.7 - Cross Site Scripting Vulnerability

Document Title: =============== Boom CMS v8.0.7 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2274 Release Date: ============= 2023-07-02 Vulnerability Laboratory ID VL-ID: ==================================== 2274...

Webile v1.0.1 - Multiple Cross Site Web Vulnerabilities

Document Title: =============== Webile v1.0.1 - Multiple Cross Site Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2321 Release Date: ============= 2023-07-02 Vulnerability Laboratory ID VL-ID: ====================================...

attackers with role "USER" can create tags

Description It seems that the users with role ""USER" has no permission with creating tags, but we do not enforce it. Ohers operation, like edit and delete has no problem. Proof of Concept pull the latest docker and setup answer 1 create a user with name "normaluser", whose role is "USER" 2 admin...

PT-2023-25588 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions 7.21 through 8.2 Description: The issue is related to reflected Cross-Site Scripting XSS, which allows an attacker to inject malicious scripts into a website. This can lead to unauthorized access to user data or session...

CVE-2023-3243

UNSUPPORTED WHEN ASSIGNED An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a...

CVE-2023-28929

Trend Micro Security 2021, 2022, and 2023 Consumer are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started...

CVE-2023-28929

Trend Micro Security 2021, 2022, and 2023 Consumer are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started...

Design/Logic Flaw

Trend Micro Security 2021, 2022, and 2023 Consumer are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started...