12024 matches found
How Malicious Android Apps Slip Into Disguise
Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research. At issue is a...
curl security update
7.76.1-23.el92.2 - unify the upload/method handling CVE-2023-28322 - fix host name wildcard checking CVE-2023-28321...
U.S. Dept Of Defense: Adobe ColdFusion Access Control Bypass - CVE-2023-38205
A vulnerability in Adobe ColdFusion was discovered that allowed bypassing access controls by using malicious path traversal in URLs targeting the /CFIDE/wizards/common/utils.cfc endpoint. This enabled attackers to reach endpoints that should have been restricted. The issue affected Adobe ColdFusi...
Design/Logic Flaw
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method...
CVE-2023-32226 Sysaid - CWE-552: Files or Directories Accessible to External Parties
Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method...
Sysaid Technologies Sysaid 代码问题漏洞
Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. A security vulnerability exists in Sysaid Technologies Sysaid versions prior to 23.2.14 b18, which stems from a malicious user with administrative privileges may be able to upload dangerous...
PT-2023-27126 · Unknown · Phpscriptpoint Recipepoint
Name of the Vulnerable Software and Affected Versions: phpscriptpoint RecipePoint version 1.9 Description: A critical issue was found in phpscriptpoint RecipePoint, affecting an unknown part of the file /recipe-result. The manipulation of the argument text/category/type/difficulty/cuisine/cooking...
phpscriptpoint RecipePoint SQL注入漏洞
RecipePoint is a SaaS multi-vendor recipe platform from the phpscriptpoint team. A SQL injection vulnerability exists in phpscriptpoint RecipePoint version 1.9, which stems from the parameter text/category/type/difficulty/cuisine/cookingmethod in the file /recipe-result that can lead to sql...
decisions.citt-tcce.gc.ca Cross Site Scripting vulnerability OBB-3552797
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
UBUNTU-CVE-2023-37895
Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...
Improper Access Control
odoo is vulnerable to Improper Access Control. The vulnerability allows an attacker to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
InterchainProposalExecutor doesn't support actions with value
Lines of code Vulnerability details Impact An interchain call consists of the target address, calldata, and value. When InterchainProposalExecutor performs the call, it passes the value along function executeProposalInterchainCalls.Call memory calls internal for uint256 i = 0; i calls.length; i++...
M-06 Unmitigated
Lines of code Vulnerability details Original Issue code-423n4/2023-06-angle-findings13 Details This issue shows users may lose a portion of yield when protocolSafetyFee and vestingPeriod are changed. As mitigation, it recommends accruing interests before those parameters are changed. Mitigation P...
CVE-2023-38205: Adobe ColdFusion Access Control Bypass [FIXED]
!CVE-2023-38205: Adobe ColdFusion Access Control Bypass \FIXED\https://blog.rapid7.com/content/images/2023/07/GettyImages-1185282377-3.jpg On July 11, 2023, Rapid7 and Adobe disclosed CVE-2023-29298, an access control bypass vulnerability affecting ColdFusion, which Rapid7 had reported to Adobe i...
How to Send a Test Email Notification Using PowerShell
This article documents a method for sending a simple email via PowerShell...
CVE-2023-38434
xHTTP 72f812d has a double free in closeconnection in xhttp.c via a malformed HTTP request method...
WordPress Shipping method for WooCommerce - Use for Conditional shipping + Extra shipping + flat rate shipping method + Table Rate Shipping for WooCommerce Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)
Software Shipping method for WooCommerce - Use for Conditional shipping + Extra shipping + flat rate shipping method + Table Rate Shipping for WooCommerce Type Plugin Vulnerable versions = 3.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Pat...
CVE-2023-38434
xHTTP 72f812d has a double free in closeconnection in xhttp.c via a malformed HTTP request method...
CVE-2023-38434
The CVE-2023-38434 issue affects the xHTTP server library (xhttp.c) where a double-free occurs in close_connection when handling a malformed HTTP request method. Root cause: freeing conn->request.public.headers.list twice. Impact: potential crash/denial of service (availability). A publicly do...
WordPress Advanced USPS Shipping Method Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)
Software Advanced USPS Shipping Method Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a753901c3acc Credits Rafie Muhammad...