341 matches found
CVE-2023-37533
HCL Connections is vulnerable to reflected cross-site scripting XSS where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal...
Oracle Linux 8 : thunderbird (ELSA-2023-6194)
The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6194 advisory. 115.4.1-1.0.1 - Update to 115.4.1 build1 - Add fix for CVE-2023-44488 Tenable has extracted the preceding description block directly from the Oracle...
Bonus for Woo < 5.8.3 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Make a logged in admin open one of the URL below...
The vulnerability of the XWiki platform for creating collaborative web applications lies in its lack of protection for website structures. This allows attackers to replace the displayed URLs with malicious ones.
The vulnerability of the XWiki Platform lies in the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to replace the displayed URL...
Design/Logic Flaw
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs...
Open Redirect
gitlab is vulnerable to Open Redirect. The vulnerability exists due to the lack of URL validation in the library, which allows an attacker to redirect users to malicious URLs and frame arbitrary content on any page allowing user-controlled markdown...
Improper Input Validation
gitlab is vulnerable to Improper Input Validation. The vulnerability exists because the Gitlab's Slack integration is incorrectly validate the user input, which allows an attacker to send maliciously crafted URLs...
Joomla Solidres 2.13.3 - Reflected XSS Vulnerability
Exploit Title: Joomla Solidres 2.13.3 - Reflected XSS Exploit Author: CraCkEr Vendor: Solidres Team Vendor Homepage: http://solidres.com/ Software Link: https://extensions.joomla.org/extension/vertical-markets/booking-a-reservations/solidres/ Demo: http://demo.solidres.com/joomla Version: 2.13.3...
Elementor < 3.5.5 - Iframe Injection
Description The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs. PoC...
Open Redirect
com.liferay.layout.seo.web is vulnerable to Open Redirect. The vulnerability exists due to the lack of validation in the backURL parameter in the layout module's SEO configuration, which allows an attacker to redirect users to malicious external URLs via the...
URLs have always been a great hiding place for threat actors
Welcome to this weeks edition of the Threat Source newsletter. Talos recent blog post on the dangers posed by the newly released ".zip" top-level domain TLD recently outlined how threat actors could create real URLs that look like file names and trick users into clicking on their links. .Zip and...
IT threat evolution in Q1 2023. Non-mobile statistics
IT threat evolution in Q1 2023 IT threat evolution in Q1 2023. Non-mobile statistics IT threat evolution in Q1 2023. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly...
CVE-2023-29725
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting...
CVE-2023-29723
The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opene...
Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts
Meta said it took steps to take down more than 1,000 malicious URLs from being shared across its services that were found to leverage OpenAI's ChatGPT as a lure to propagate about 10 malware families since March 2023. The development comes against the backdrop of fake ChatGPT web browser extensio...
Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts
Meta said it took steps to take down more than 1,000 malicious URLs from being shared across its services that were found to leverage OpenAI's ChatGPT as a lure to propagate about 10 malware families since March 2023. The development comes against the backdrop of fake ChatGPT web browser extensio...
CVE-2023-1965
Removed by vendor...
CVE-2023-1965
An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access toke...
Server-side Request Forgery (SSRF)
lambdaisland:uri is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to the authority-regex which allows an attacker to send malicious URLs to be parsed without properly handling the backslash \ character in the host, allowing an attacker to parse an untrusted source...
GHSA-CP4W-6X4W-V2H5 lambdaisland/uri `authority-regex` returns the wrong authority
Summary authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to CVE-2020-8910. Details https://github.com/lambdaisland/uri/blob/d3355fcd3e235238f4dcd37be97787a84e580072/src/lambdaisland/uri.cljcL9 This...