Microsoft continues to innovate to help secure small businesses

Small and medium-sized businesses are at the heart of our economy and are dedicated to driving value for their customers, whether that means trying new recipes, exploring new inventory, expanding services, arranging the shop so it’s easier to navigate, or keeping the shelves stocked with the...

CVE-2023-23192

IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task...

CVE-2023-28432

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. All users of...

Code injection

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...

CVE-2023-28434

CVE-2023-28434 (MinIO) affects MinIO’s object storage framework. A security feature bypass allows an attacker with credentials for arn:aws:s3:::* and Console API access to bypass metadata bucket name checking during PostPolicyBucket and place objects into arbitrary buckets. This can impact confid...

CVE-2023-28434 MinIO is vulnerable to privilege escalation on Linux/MacOS

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...

CVE-2023-28433

MinIO on Windows is affected by a privilege-escalation issue where the product fails to filter the backslash () character, enabling an attacker with low privileges (e.g., a limited PutObject key) to place objects across buckets and create an admin user. The concrete root cause is path separator h...

CVE-2023-28433 Minio Privilege Escalation on Windows via Path separator manipulation

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the \ character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key,...

CVE-2023-28432 Minio Information Disclosure in Cluster Deployment

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. All users of...

CVE-2023-28432

CVE-2023-28432 affects MinIO in cluster deployments from releases before RELEASE.2023-03-20T20-16-18Z, where MinIO may disclose all environment variables including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD. The issue is triggered by an information-disclosure flaw in the bootstrap/verify flow, enab...

CVE-2023-28432

Last updated 21 August 2024...

Amazon Linux 2023 : vsftpd (ALAS2023-2023-019)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-019 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates...

CLSA-2023-1679350332 curl: Fix of CVE-2023-23916

CVE-2023-23916: fix HTTP multi-header compression denial of service - fix testing system by adding the nonewline option...

CVE-2022-47591

Reflected Cross-Site Scripting XSS vulnerability in Mickael Austoni Map Multi Marker plugin = 3.2.1 versions...

Cross site scripting

Reflected Cross-Site Scripting XSS vulnerability in Mickael Austoni Map Multi Marker plugin = 3.2.1 versions...

CVE-2022-47591

The CVE-2022-47591 entry documents a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress Map Multi Marker plugin versions ≤ 3.2.1. The root cause is insufficient sanitisation/escaping of user input reflected in the page, enabling an attacker to inject scripts. Affected product: Ma...

Simple Giveaways < 2.45.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Login with admin user and navigate to "Giveawa...

WordPress plugin Map Multi Marker 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-1470

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Cross site scripting

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...