This flaw allows an attacker to insert cookies at will into a running program using libcurl if the specific series of conditions are met. libcurl performs transfers. In its API an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program usin

...

JumpServer Bypass Password

The vulnerability of the application software interface of the JumpServer security audit system for operation and maintenance involves insufficient protection of operational data during the loading of external libraries. Exploiting this vulnerability allows a malicious actor to remotely reset...

PT-2023-6062

Name of the Vulnerable Software and Affected Versions Windows Container Manager affected versions not specified Description The issue concerns an elevation-of-privilege vulnerability in the Windows Container Manager service, which can be exploited by an attacker to elevate their privileges. This...

nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()

A vulnerability was found in NodeJS. This security issue occurs as the use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module...

CVE-2023-43697

Modification of Assumed-Immutable Data MAID in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

nodejs: mainModule.proto bypass experimental policy mechanism

A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition...

radare2:ia_fuzz: Crash in r_str_ncpy

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=4713927067697152 Project: radare2 Fuzzing Engine: libFuzzer Fuzz Target: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type: UNKNOWN READ Cra...

DAR-7000 router Arbitrary Command Execution

The vulnerability of the /log/webmailattach.php script in the DAR-7000 router microprogramming system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

DAR-7000 Router Arbitrary Command Execution

The vulnerability in the /sysmanage/updateos.php script of the DAR-7000 router’s microprogramming system involves unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the curleasyduphandle function, allowing an attacker to insert cookies into a running program using this library. When this function is used to duplicate an easy handle with cookies enabled, the...

batik: Server-Side Request Forgery vulnerability

A flaw was found in Apache Batik 1.0 - 1.16. This issue occurs due to a malicious SVG triggering external resources loading by default, causing resource consumption or in some cases information disclosure...

CVE-2023-40661

Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a...

D-Link DAR-8000 Router Arbitrary Command Execution

The vulnerability in the /sysmanage/changelogo.php script of the D-Link DAR-8000 router’s microprogramming system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

D-Link DAR-7000 Router Arbitrary Command Execution

The vulnerability of the /sysmanage/updateos.php script of the D-Link DAR-7000 router’s microprogramming system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PyTorch Model Server Registration and Deserialization RCE

The PyTorch model server contains multiple vulnerabilities that can be chained together to permit an unauthenticated remote attacker arbitrary Java code execution. The first vulnerability is that the management interface is bound to all IP addresses and not just the loop back interface as the...

GHSA-8FXR-QFR9-P34W TorchServe Server-Side Request Forgery vulnerability

Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...

BunnyLoader: New Malware-as-a-Service Threat Emerges in the Cybercrime Underground

Cybersecurity experts have discovered yet another malware-as-a-service MaaS threat called BunnyLoader that's being advertised for sale on the cybercrime underground. "BunnyLoader provides various functionalities such as downloading and executing a second-stage payload, stealing browser credential...

PT-2023-5886

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 8.4.0 Description This issue allows an attacker to insert cookies at will into a running program using libcurl, if specific series of conditions are met. libcurl performs transfers and provides a function call that...

nodejs: Permissions policies can be bypassed via Module._load

A vulnerability was found in NodeJS. This security issue occurs as the use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module...

InPlant SCADA Privilege Escalation

The vulnerability of the InPlant SCADA system is related to deficiencies in the authentication process when loading project files. Exploiting this vulnerability can allow attackers to enhance their privileges...