MAL-2023-8365 Malicious code in python-aliyun-sdk-ecs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fcb822b0528f2cbde54bd2197ed8c774dda8cafc7c3e9ae5aff56465e7c6c72c Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

GHSA-VMCH-3W2X-VHGQ .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2023-38180: .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1, .NET 6.0, and .NET 7.0. This advisory also provides guidance on what developers can do...

CVE-2023-4243

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing...

WordPress plugin FULL - Customer code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin FULL - Customer A...

CVE-2023-4243: Improper Authorization

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in OLEDB, a component used by clients to communicate with SQL Server. A malicious party could exploit the vulnerability to execute arbitrary execute arbitrary code on the client using OLEDB. The malicious party must trick the victim into contacting a rogue SQL...

VulnCheck KEV: CVE-2023-4243

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing...

PT-2023-28336 · WordPress · Full - Customer

Name of the Vulnerable Software and Affected Versions: The FULL - Customer plugin for WordPress versions up to, and including, 2.2.3 Description: The issue allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote...

Bypassing Install Dialog

chromium is vulnerable to Bypassing Install Dialog. The vulnerability exists due to the inappropriate implementation in WebApp Installs of the library, which allows an attacker to convince a user to install a malicious web app to bypass the install dialog via a maliciously crafted HTML page...

CVE-2023-38947

An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file...

PrivKit - Simple Beacon Object File That Detects Privilege Escalation Vulnerabilities Caused By Misconfigurations On Windows OS

PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS. PrivKit detects following misconfigurations Checks for Unquoted Service Paths Checks for Autologon Registry Keys Checks for Always Install Elevated Registry Keys...

PT-2023-26701 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.6.1 Description: An arbitrary file upload issue in the /languages/install.php component allows attackers to execute arbitrary code via a crafted PHP file. The "languages/install.php" component is specifically vulnerable,...

WBCE CMS 代码问题漏洞

WBCE CMS is an open source content management system CMS based on PHP and MySQL. An arbitrary file upload vulnerability exists in WBCE CMS version 1.6.1, which stems from the lack of validation of uploaded files in the /languages/install.php component. The vulnerability can be exploited to remote...

SpyNote Spyware Returns with SMS Phishing Against Banking Customers

By Habiba Rashid In its recent attack campaign, SpyNote Spyware is sending victims fake SMS messages urging them to install a new certified banking app. This is a post from HackRead.com Read the original post: SpyNote Spyware Returns with SMS Phishing Against Banking Customers...

Fedora: Security Advisory for mingw-qt5-qtbase (FEDORA-2023-5ead27b6d2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-14293 · Arm · Arm Compiler 5 (Ac5) +11

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue arises when the installation directory lacks sufficiently restrictive file permissions, allowing an attacker to modify files and execute malicious code. Recommendations: At the...

SUSE: Security Advisory (SUSE-SU-2023:3001-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for kernel (FEDORA-2023-3661f028b8)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vasion PrinterLogic Client 安全漏洞

Vasion PrinterLogic Client is a print management solution from Vasion. A security vulnerability exists in Vasion PrinterLogic Client Windows versions prior to 25.0.0.818, which stems from a binary file that can be executed from a subfolder in C:WindowsTemp during installation...

Path Traversal

github.com/nothub/mrpack-install is vulnerable to Path Traversal. The vulnerability exists because it does not properly validate downloaded files for subpaths, which allows an attacker to access files outside the restricted directory...