11299 matches found
CVE-2023-2484
CVE-2023-2484 : The Active Directory Integration / LDAP Integration plugin for WordPress is affected in versions up to 4.1.4 by time-based SQL Injection via the vulnerable orderby and order parameters due to insufficient escaping and lack of proper SQL preparation. Exploitation requires authentic...
PT-2023-19818 · WordPress · Active Directory Integration
Name of the Vulnerable Software and Affected Versions: Active Directory Integration plugin for WordPress versions up to and including 4.1.4 Description: The issue allows for time-based SQL Injection due to insufficient escaping on the user-supplied orderby and order parameters and lack of...
Analyzing the FUD Malware Obfuscation Engine BatCloak
We look into BatCloak engine, its modular integration into modern malware, proliferation mechanisms, and interoperability implications as malicious actors take advantage of its fully undetectable FUD capabilities...
PT-2023-20414 · WordPress · Active Directory Integration
Name of the Vulnerable Software and Affected Versions: Active Directory Integration plugin for WordPress versions up to, and including, 4.1.4 Description: The issue allows unauthenticated attackers to perform time-based SQL Injection via the orderby and order parameters due to missing nonce...
WordPress Plugin Active Directory Integration 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
WordPress Plugin Active Directory Integration SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...
Vapor's Metrics integration could cause a system drain
This is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app with the following attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create “unlimited” counters and timers, which will eventually drain the system. 2...
UBUNTU-CVE-2023-29404
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...
This Week in Spring - June 6th, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! And what an insane week it's been! Long story short, I've spent 10-12 hours a day over the last five days migrating a dozen differnet applications and services from one GKE cluster to another, taking the time to update things...
Marketplace may call onERC721Received() and create a lien during buyNftFromMarket(), creating divergence
Lines of code Vulnerability details Impact The contract supports a "push-based" NFT supply, where the price and rate are embedded in the data bytes. This way, the lender doesn't need to additionally approve the NFT but can just transfer it directly to the contract. However, since the contract als...
TotalCloud Empowered with CloudView Integration
Qualys, a leading provider of cloud-based security and compliance solutions, offers Qualys TotalCloud - a unified vulnerability, threat, and posture management solution. This solution simplifies cloud infrastructure security by combining essential components such as Cloud Workload Protection, Clo...
CVE-2023-28937
DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in ScriptRunner and...
PT-2023-22047 · Unknown · Scriptrunner For Amazon Sqs +2
Name of the Vulnerable Software and Affected Versions: DataSpider Servista versions 4.4 and earlier Description: The issue concerns the use of a hard-coded cryptographic key in DataSpider Servista, which is data integration software. This key is embedded in ScriptRunner and ScriptRunner for Amazo...
DRUPAL-CONTRIB-2023-016
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting XSS vulnerability. Th...
Iubenda Integration - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-016
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting XSS vulnerability. Th...
JVN#38222042: DataSpider Servista uses a hard-coded cryptographic key
DataSpider Servista provided by SAISON INFORMATION SYSTEMS CO.,LTD. is a data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in ScriptRunner and ScriptRunner for Amazon SQS,...
PrinterLogic Build 1.0.757 XSS / SQL Injection / Authentication Bypass
PrinterLogic SaaS, multiple vulnerabilities =========================================================== PrinterLogic's Enterprise Print Management software allows IT professionals to simplify printer driver management and empower end users. -- https://www.printerlogic.com/ Background...
WordPress Worthy – VG WORT Integration für WordPress Plugin <= 1.6.5-6497609 is vulnerable to Cross Site Request Forgery (CSRF)
Software Worthy – VG WORT Integration für WordPress Type Plugin Vulnerable versions = 1.6.5-6497609 Fixed in 1.7.0-0cde1c2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-24417 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PS...
[SECURITY] Fedora 37 Update: python-vkbasalt-cli-3.1.1.post1-1.fc37
vkbasalt-cli is a CLI utility and library in conjunction with vkBasalt. This makes generating configuration files or running vkBasalt with games easier. This is mainly convenient in environments where integrating vkBasalt is wishful, for example a GUI application. Integrating vkbasalt-cli allows ...