2873 matches found
CVE-2023-51485
CVE-2023-51485 is a Cross-Site Scripting (Stored XSS) vulnerability in the WordPress plugin “Pay with Vipps for WooCommerce” (WP Pay with Vipps). The issue arises from improper neutralization of user input during web page generation, allowing stored XSS. Affected versions are up to 1.14.13 (inclu...
CVE-2024-22836
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server...
Command injection
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server...
CVE-2024-22836
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server...
CVE-2024-22836
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server...
CVE-2024-22836
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server...
axhosting.net Improper Access Control vulnerability OBB-3850266
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
[slackware-security] expat
New expat packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/expat-2.6.0-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fix quadratic runtime issues with big tokens that can cau...
UNC4990 Leverage Hosting Platforms in USB Infection Chain
Summary: UNC4990, a financially motivated threat actor, has been observed targeting organizations in Italy by utilizing weaponized USB drives as an initial infection vector. Additionally, they are employing trusted websites such as Vimeo, GitHub, and Ars Technica to host encoded payloads disguise...
CVE-2024-23641 Sending a GET or HEAD request with a body crashes SvelteKit
SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg to a built and previewed/hosted sveltekit app throws Request with GET/HEAD method cannot have body. and crashes the preview/hosting. After this happens, one must manually restart the app. TRACE requests will...
[slackware-security] tigervnc
New tigervnc packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/tigervnc/tigervnc-1.12.0-i586-5slack15.0.txz: Rebuilt. Recompiled against xorg-server-1.20.14, including the latest patches for several securit...
[slackware-security] gnutls
New gnutls packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/gnutls-3.8.3-i586-1slack15.0.txz: Upgraded. This update fixes two medium severity security issues: Fix more timing side-channel inside...
CVE-2024-21654
CVE-2024-21654 affects Rubygems.org, the Ruby package hosting service. A flaw in the forgotten-password flow allows bypassing MFA, enabling account takeover. Root cause: a workaround in the password-reset form. Impact: high (CVE details indicate potential total compromise of an affected account)....
Meet Ika & Sal: The Bulletproof Hosting Duo from Hell
In 2020, the United States brought charges against four men accused of building a bulletproof hosting empire that once dominated the Russian cybercrime industry and supported multiple organized cybercrime groups. All four pleaded guilty to conspiracy and racketeering charges. But there is a...
Surging JavaScript Threats Steal Your Secrets
Summary: The threat actors utilize malicious JavaScript samples, taking advantage of popular survey sites, low-quality hosting, and web chat APIs to steal sensitive information. They create chatbots registered under notable figures, like an Australian footballer, in specific campaigns...
CVE-2023-50725
A cross-site scripting flaw was found in Resque due to improper validation of user-supplied input by the resque-web failed and queues lists. This issue could allow a remote authenticated attacker to use a specially crafted URL to execute script in a victim's web browser within the security contex...
Hackers Abusing GitHub to Evade Detection and Control Compromised Hosts
Threat actors are increasingly making use of GitHub for malicious purposes through novel methods, including abusing secret Gists and issuing malicious commands via git commit messages. "Malware authors occasionally place their samples in services like Dropbox, Google Drive, OneDrive, and Discord ...
Denial Of Service (DoS)
ckan is vulnerable to Denial of Service DoS. The vulnerability exists because it does not properly validate the auth cookie in init.py which allows an attacker to create an out-of-memory error in the hosting server...
GHSA-7FGC-89CX-W8J5 Out of memory error when submitting the dataset form with a specially-crafted field
Impact When submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create o...
Authorization
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-craft...