CVE-2023-38487 HedgeDoc API allows to hide existing notes

HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the new one...

NYC Couple Pleads Guilty to Money Laundering in $3.6 Billion Bitfinex Hack

A married couple from New York City has pleaded guilty to money laundering charges in connection with the 2016 hack of cryptocurrency stock exchange Bitfinex, resulting in the theft of about 120,000 bitcoin. The development comes more than a year after Ilya Lichtenstein, 35, and his wife, Heather...

COURIER DEPRIXA 2.5 Cross Site Request Forgery

==================================================================================================================================== | Title : COURIER DEPRIXA V2.5 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 102.0.164-bit | |...

CLSA-2023-1691083341 Update of alt-php

Update ca-certificates database to 20230629: - mozilla/certdata.txt,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.62. - The following certificate authorities were added: Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS" Certificate "ANF Secure Server Root CA" Certificate...

Courier Deprixa Pro Integrated Web System 3.2.5 Cross Site Request Forgery

==================================================================================================================================== | Title : Courier Deprixa Pro - Integrated Web System v3.2.5 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

Fleek Network Releases New Whitepaper for Decentralized Edge Platform

By Owais Sultan Brooklyn, New York, 31 July 2023 – Fleek Network has released a new whitepaper describing the decentralized edge… This is a post from HackRead.com Read the original post: Fleek Network Releases New Whitepaper for Decentralized Edge Platform...

Webmin 跨站脚本漏洞

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.021 that stems from the discovery of a Stored Cross-Site Scripting XSS vulnerability in the Users and Groups feature. The...

PT-2023-23713 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe Framework versions prior to 4.13.4 Silverstripe Framework versions prior to 5.0.13 Description: The issue arises when a new member record is created without setting a password, resulting in an empty encrypted password. If an...

Metasploit Weekly Wrap up

Unauthenticated RCE in VMware Product This week, community contributor h00die added an exploit module that leverages a command injection vulnerability in VMWare Aria Operations for Networks, formerly known as vRealize Network Insight. Versions 6.2 to 6.10 are vulnerable CVE-2023-20887. A remote...

new-year.bz Cross Site Scripting vulnerability OBB-3553329

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Front run attacks during the 7 day cooldown period in setGSCAllowance.

Lines of code Vulnerability details Impact A malicious miner can send a transaction from the GSC to drain the new allowance before the admin's transaction sets it. Proof of Concept The setGSCAllowance function sets a 7 day cooldown period between allowance changes for each token. This prevents th...

Malicious code in tecno-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 031d3e0a1576d7fedc52920ce24b349bbcefa4fc7c381855f1bcbdc0b82a4dd6 The OpenSSF Package Analysis project identified 'tecno-new' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1314 Malicious code in tecno-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 031d3e0a1576d7fedc52920ce24b349bbcefa4fc7c381855f1bcbdc0b82a4dd6 The OpenSSF Package Analysis project identified 'tecno-new' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

Apache Tomcat SEoL (8.5.x)

According to its version, Apache Tomcat is 8.5.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

CVE-2023-31466

An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration - Compliance - Add a new compliance report" and "Configuration - Timekeeper Configuration - Add a new source there" screens, there are entry points to inject JavaScript code...

CVE-2023-31466

An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration - Compliance - Add a new compliance report" and "Configuration - Timekeeper Configuration - Add a new source there" screens, there are entry points to inject JavaScript code...

New York Using AI to Detect Subway Fare Evasion

The details are scant--the article is based on a "heavily redacted" contract--but the New York subway authority is using an "AI system" to detect people who dont pay the subway fare. Joana Flores, an MTA spokesperson, said the AI system doesnt flag fare evaders to New York police, but she decline...

Important: gstreamer1-plugins-base

Issue Overview: Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Affected Packages: gstreamer1-plugins-base Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Medium: libtiff

Issue Overview: Memory leak in memory leak in tiffcrop.c. CVE-2023-3576 Affected Packages: libtiff Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update libtif...

Medium: icu

Issue Overview: International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. CVE-2020-21913 Affected Packages: icu Note: This advisory is applicable to Amazon Linux 2 AL2 Core...