1599 matches found
CVE-2020-19660
Cross Site Scripting XSS pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values...
CVE-2020-19660
Cross Site Scripting XSS pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values...
CVE-2020-19660
Cross Site Scripting XSS pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values...
CVE-2020-19660
Cross Site Scripting XSS pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values...
CVE-2020-19660: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values...
Malicious code in api-code-capture-chrome-extension (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1e44f89c4e3876559f46852c9a652c510df9384be3ffd0180e36f9fd64e8cfe The OpenSSF Package Analysis project identified 'api-code-capture-chrome-extension' @ 20.0.1 npm as malicious. It is considered malicious becaus...
Malicious code in proton-pack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c87e5ff9b7fca2cbd9b8c5f66c8849dd5f06f3e36574d1e902b216d332a207ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2023-22455 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad versions 5.3.x through 5.3.x Description: The issue allows an authenticated attacker to gain information about linked accounts of users involved in their tickets using the Zammad API. This is due to Incorrect Access Control...
Daggerfly Cyberattack Campaign Hits African Telecom Services Providers
Telecommunication services providers in Africa are the target of a new campaign orchestrated by a China-linked threat actor at least since November 2022. The intrusions have been pinned on a hacking crew tracked by Symantec as Daggerfly, and which is also monitored by the broader cybersecurity...
Russia-Linked Hackers Launches Espionage Attacks on Foreign Diplomatic Entities
The Russia-linked APT29 aka Cozy Bear threat actor has been attributed to an ongoing cyber espionage campaign targeting foreign ministries and diplomatic entities located in NATO member states, the European Union, and Africa. According to Poland's Military Counterintelligence Service and the CERT...
OracleVM 3.4 : kernel-uek (OVMSA-2023-0007)
The remote OracleVM system is missing necessary patches to address security updates: - The mincore implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing ...
Arid Viper Hacking Group Using Upgraded Malware in Middle East Cyber Attacks
The threat actor known as Arid Viper has been observed using refreshed variants of its malware toolkit in its attacks targeting Palestinian entities since September 2022. Symantec, which is tracking the group under its insect-themed moniker Mantis, said the adversary is "going to great lengths to...
CVE-2023-1777
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message...
CVE-2023-1777 Information disclosure in linked message previews
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message...
Mattermost 信息泄露漏洞
Mattermost is an open source collaboration platform from US-based Mattermost. Mattermost suffers from a message disclosure vulnerability that stems from allowing an attacker to disclose the contents of linked messages by requesting a preview of an existing message when creating a new message via ...
PT-2023-17237 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to request a preview of an existing message when creating a new message via the "createPost API call", disclosing the contents of the linked message...
CVE-2023-28426
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: GHSA-xrqq-wqh4-5hg2. Reason: Further investigation showed that this CVE was assigned in error. Notes: See https://github.com/darylldoyle/svg-sanitizer/issues/88 for a technical discussion...
China-linked Hackers Targeting Unpatched SonicWall SMA Devices with Malware
A suspecting China-linked hacking campaign has been observed targeting unpatched SonicWall Secure Mobile Access SMA 100 appliances to drop malware and establish long-term persistence. "The malware has functionality to steal user credentials, provide shell access, and persist through firmware...