16066 matches found
PT-2023-31867 · Nautobot · Nautobot
Name of the Vulnerable Software and Affected Versions: Nautobot versions prior to 1.6.8 Nautobot versions prior to 2.1.0 Description: Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL...
The vulnerability of the security system and the Nessus vulnerability assessment, which stems from insufficient validation of input data, allows attackers to elevate their privileges to the root or NT AUTHORITY/SYSTEM level on the Nessus host.
The vulnerability of the Nessus security system and its vulnerability assessment are related to insufficient checking of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to elevate their privileges to the root or NT AUTHORITY/SYSTEM level on the Nessus...
Nautobot Security Vulnerability
Nautobot is a web automation platform from the individual developers of Nautobot. A security vulnerability exists in Nautobot version 1.5.14 and earlier, which stems from not checking object-level permissions when submitting a job to be run via the Job Button...
CVE-2023-0011 Command Execution through Serial Interface of u-blox TOBY-L2
A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial...
The Kuiper Ransomware Surge and Its Dark Origins
Summary: In a predominantly Russian Dark Web forum, a sophisticated ransomware-as-a-service RaaS project named "KUIPER" was introduced. The Kuiper ransomware, developed in Golang, is compatible with Windows, Linux, and OSX systems, and is associated with a suspected intrusion at a government...
Unchecked return value of low-level call()/delegatecall()
Lines of code 120, 141, 411, 184, 160, 189, 152, 444, 625, 638https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contract...
Limit Login Attempts Reloaded < 2.25.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
Unchecked return value of low-level call()/delegatecall()
Lines of code 120, 141, 411, 184, 160, 189, 152, 444, 625, 638https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contract...
containerd allows RAPL to be accessible to a container
/sys/devices/virtual/powercap accessible by default to containers Intel's RAPL Running Average Power Limit feature, introduced by the Sandy Bridge microarchitecture, provides software insights into hardware energy consumption. To facilitate this, Intel introduced the powercap framework in Linux...
GHSA-7WW5-4WQC-M92C containerd allows RAPL to be accessible to a container
/sys/devices/virtual/powercap accessible by default to containers Intel's RAPL Running Average Power Limit feature, introduced by the Sandy Bridge microarchitecture, provides software insights into hardware energy consumption. To facilitate this, Intel introduced the powercap framework in Linux...
Gaza Cybergang’s Pierogi++ Upgrade Takes Center Stage
Summary: The Gaza Cybergang, a sophisticated threat actor, has recently intensified its attacks by deploying an advanced version of the Pierogi backdoor malware. This group focuses its cyber operations primarily on Palestinian entities and Israel, with a historical record of targeting entities...
Cross site scripting
The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
Cross site scripting
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subutton', 'sumembers', and 'sutabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplie...
CVE-2023-6488 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subutton', 'sumembers', and 'sutabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplie...
SpeedyCache < 1.1.4 - Missing Authorization to Plugin Options Update
Description The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycachesavevarniship, speedycacheimgupdatesettings, speedycachepreloadingaddsettings, and speedycachepreloadingdeleteresource functions in all versions ...
PT-2023-31410 · Elastic · Elasticsearch
Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.17.16 Elasticsearch versions prior to 8.11.2 Description: An issue was discovered whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents...
Image horizontal reel scroll slideshow < 13.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
Unchecked return value of low-level call()/delegatecall()
Lines of code 120, 141, 411, 184, 160, 189, 152, 444, 625, 638https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contract...
Rhadamanthys Stealer Version 0.5.0 Upgrade Overview
Summary: Rhadamanthys, the information-stealing malware, has taken a significant leap with its v0.5.0 upgrade, introducing expanded stealing features, raw syscalls, and an enhanced loader design, showcasing advanced evasion techniques. Its modular architecture allows for continuous updates,...
Fedora: Security Advisory (FEDORA-2023-3fbd936b15)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...