IssabelPbx 跨站请求伪造漏洞

IssabelPbx is an open source Gui graphical user interface from the Issabel Foundation. It is used to control and manage Asterisk Pbx. A security vulnerability exists in Issabel issabel-pbx version v.4.0.0-6, which originated from a vulnerability that allows remote attackers to gain privileges via...

Alhotphp Article CMS 1.0 Cross Site Request Forgery

==================================================================================================================================== | Title : Alhotphp article CMS 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.332-bit | |...

InventoryPress <= 1.7 - Author+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks. 1. Create a "New Inventory Item" 2. In the "Description" field, add the value "alert"xss" 3. Edit the created item and see the XS...

An Overview of the Different Versions of the Trigona Ransomware

The Trigona ransomware is a relatively new ransomware family that began activities around late October 2022 — although samples of it existed as early as June 2022. Since then, Trigona’s operators have remained highly active, and in fact have been continuously updating their ransomware binaries...

cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`

The function ChunkId::new creates a misaligned pointer by casting mutable pointer of u8 slice which has alignment 1 to the mutable pointer of u32 which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function...

CVE-2023-27439

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in glSPICE New Adman plugin = 1.6.8 versions...

CVE-2023-27439

CVE-2023-27439 describes an Admin+ authenticated Stored Cross-Site Scripting (XSS) in the WordPress New Adman plugin (versions

SUSE-SU-2023:2594-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: release-notes-susemanager: - Update to 4.2.13 Salt has been upgraded to 3006.0 SUSE Linux Enterprise Server 15 SP5 Family support has been added openSUSE Leap 15.5 support has been added Automatic migration from Salt 3000 to Salt bundle Grafana upgraded to...

SUSE-SU-2023:2581-1 Security update for salt

This update for salt fixes the following issues: - Update to Salt release version 3006.0 jscPED-4361 See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add missing patch after rebase to fix collections Mapping issues - Add python3-looseversion as new dependency...

semver vulnerable to Regular Expression Denial of Service

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

GHSA-C2QF-RXJJ-QQGW semver vulnerable to Regular Expression Denial of Service

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

AZL-43534 CVE-2022-25883 affecting package nodejs-nodemon 2.0.3-4

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

CVE-2022-25883

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

WordPress plugin New Adman 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Data Breach at New BreachForums: 4,000 members’ data leaked

By Waqas BreachForums is a recently resurfaced alternative to the popular hacker and cybercrime forum, Breach Forums, which is now defunct. This is a post from HackRead.com Read the original post: Data Breach at New BreachForums: 4,000 members’ data leaked...

Data Breach at New BreachForums: 4,000 members’ data leaked

By Waqas BreachForums is a recently resurfaced alternative to the popular hacker and cybercrime forum, Breach Forums, which is now defunct. This is a post from HackRead.com Read the original post: Data Breach at New BreachForums: 4,000 members data leaked...

CVE-2023-1183

A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker...

PT-2023-5239 · Unknown · C-Data Web Management System

Name of the Vulnerable Software and Affected Versions: C-DATA Web Management System up to 20230607 Description: A critical issue affects the User Creation Handler component of the C-DATA Web Management System, specifically the file /cgi-bin/jumpto.php?class=user&page=config save&isphp=1. The...

Bludit 代码问题漏洞

Bludit is an open source lightweight blog content management system CMS. A code issue vulnerability exists in Bludit v3.14.1, which stems from an arbitrary file upload vulnerability in the component /admin/new-content that allows an attacker to execute arbitrary web script or HTML by uploading a...

PT-2023-25030 · Bludit · Bludit

Name of the Vulnerable Software and Affected Versions: Bludit version 3.14.1 Description: The issue allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file in the /admin/new-content component. This is possible due to an arbitrary file upload vulnerability. It's...