CVE-2023-36821

CVE-2023-36821 affects Uptime Kuma prior to 1.22.1. An authenticated user can install a malicious plugin via the plugin installation flow, where plugins are installed with npm in the plugin directory. The plugin validation relies on an official plugin list and does not disable npm scripts during ...

CVE-2023-36821 Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libexpat denial of service( CVE-2022-43680)

Summary Potential libexpat denial of service vulnerability CVE-2022-43680 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-43680 DESCRIPTION: libexpat is vulnerable to a denial of...

Node.js Users Beware: Manifest Confusion Attack Opens Door to Malware

The npm registry for the Node.js JavaScript runtime environment is susceptible to what's called a manifest confusion attack that could potentially allow threat actors to conceal malware in project dependencies or perform arbitrary script execution during installation. "A npm package's manifest is...

Exploit for Cross-site Scripting in Citrix Gateway

CVE-2023-24488 POC for CVE-2023-24488 Citrix Gateway...

CVE-2023-37378

Nullsoft Scriptable Install System NSIS before 3.09 mishandles access control for an uninstaller directory...

Directory traversal

Nullsoft Scriptable Install System NSIS before 3.09 mishandles access control for an uninstaller directory...

UBUNTU-CVE-2023-37378

Nullsoft Scriptable Install System NSIS before 3.09 mishandles access control for an uninstaller directory...

Security Bulletin: Vulnerability in Spring Framework affects IBM Process Mining [CVE-2016-1000027]

Summary There is a vulnerability in Spring Framework that could allow a remote attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. CVE-2016-1000027 Vulnerability Details...

CVE-2023-3438

An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service mvagtsce.exe. The misconfiguration allowed an unauthorized local user to insert arbitrary code into the unquoted service path to obtain privilege escalation and stop antimalwar...

CVE-2023-3438

An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service mvagtsce.exe. The misconfiguration allowed an unauthorized local user to insert arbitrary code into the unquoted service path to obtain privilege escalation and stop antimalwar...

Exploit for Improper Authentication in Wpdeveloper Essential_Addons_For_Elementor

WP-CVE-2023-32243 Python 2.7 Buy Coffee : Bitcoin $: 14nXhmR...

PT-2023-4535

Name of the Vulnerable Software and Affected Versions Nullsoft Scriptable Install System NSIS versions prior to 3.09 Description The issue is related to insufficient access control in the Nullsoft Scriptable Install System, which can be exploited by a remote attacker to elevate their privileges...

Nullsoft Scriptable Install System 安全漏洞

Nullsoft Scriptable Install System is a professional open source system for creating Windows installers. A security vulnerability exists in Nullsoft Scriptable Install System NSIS versions prior to 3.09, which stems from improper handling of access control to the uninstaller directory...

CVE-2023-37378

Nullsoft Scriptable Install System NSIS before 3.09 mishandles access control for an uninstaller directory...

CVE-2023-37378

Nullsoft Scriptable Install System NSIS before 3.09 mishandles access control for an uninstaller directory...

The vulnerability of the Google Chrome browser’s extension can compromise their integrity and also lead to service failures.

The vulnerability of the Google Chrome browser extension is related to the overflow of the heap buffer and the installation of malicious extensions. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service interruptions throug...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in WavPack ( CVE-2021-44269)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in WavPack, caused by a heap out-of-bounds read flaw in WavpackPackSamples function in src/packutils.c CVE-2021-44269. WavPack is included as part of the runtimes in our service. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in TensorFlow (CVE-2023-25658)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in TensorFlow, caused by an out-of-bounds read in GRUBlockCellGrad CVE-2023-25658. TensorFlow is included as part of the runtimes in our service. This vulnerabilitiy has been addressed...

Missing Authorization

github.com/mattermost/mattermost-server is vulnerable to Missing Authorization. The vulnerability exists because the library does not verify whether the requestor is a system admin or not before allowing install requests to the Apps, allowing regular users to send malicious install requests to th...