Terminalfour 安全漏洞

Terminalfour is a digital marketing and web content management platform for higher education from Terminalfour, Inc. Terminalfour suffers from an information disclosure vulnerability that stems from insufficient protection of sensitive information when debug logging is enabled. An attacker could...

Jenkins Plugin Azure Key Vault 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Citrix Policies are not applied and VDAs become unregistered if a policy is updated in Studio.

Citrix polices no longer apply to the VDA . These are policies created in Citrix Studio . Issue not seen with policies created with MS GPOs. In addition If a policy is updated in Studio then VDAs become immediately unregistered and users are unable to logon. In Director“configuration Set Failure“...

CVE-2023-1912

The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-1912

The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2023-17334 · WordPress · Limit Login Attempts

Name of the Vulnerable Software and Affected Versions: Limit Login Attempts plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Stored Cross-Site Scripting via the lock logging feature due to insufficient input sanitization and output escaping. This allo...

Important: log4j

Issue Overview: A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests...

CVE-2023-27488

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when failuremodeallow: true is configured for extauthz filter. For affected components that are used for loggin...

Design/Logic Flaw

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when failuremodeallow: true is configured for extauthz filter. For affected components that are used for loggin...

CVE-2023-27488 Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when failuremodeallow: true is configured for extauthz filter. For affected components that are used for loggin...

Design/Logic Flaw

In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file...

CVE-2022-48435

CVE-2022-48435 affects JetBrains PhpStorm prior to 2023.1. The vulnerability allows source code to be logged in the local idea.log file due to how PhpStorm handles logging. Reported across multiple sources (NVD/Red Hat/CNNVD and related notices). Impact is framed as information disclosure within ...

CVE-2022-48435

In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file...

CVE-2022-48435

In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file...

PT-2023-15778 · Jetbrains · Phpstorm

Name of the Vulnerable Software and Affected Versions: JetBrains PhpStorm versions prior to 2023.1 Description: The issue allows source code to be logged in the local idea.log file. Recommendations: For versions prior to 2023.1, update to version 2023.1 or later to resolve the issue...

Crypto-Stealing OpcJacker Malware Targets Users with Fake VPN Service

A piece of new information-stealing malware called OpcJacker has been spotted in the wild since the second half of 2022 as part of a malvertising campaign. "OpcJacker's main functions include keylogging, taking screenshots, stealing sensitive data from browsers, loading additional modules, and...

CVE-2023-1580

Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling up the disk and render the system unusable...

CVE-2023-1580

Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling up the disk and render the system unusable...

Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution Vulnerability

Exploit Title: Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution RCE + Centos Web Panel 7 - 0.9.8.1147 + Affected Component ip:2031/login/index.php?login=$whoami + Discoverer: Numan Türle @ Gais Cyber Security + Author: Numan Türle + Vendor: https://centos-webpanel.com/ -...

Devolutions Gateway 资源管理错误漏洞

Devolutions Gateway is a fast relay server from Devolutions Canada that adapts to different protocols and required traffic inspection levels. A security vulnerability exists in Devolutions Gateway version 2023.1.1 and prior versions that stems from uncontrolled resource consumption in the logging...