8345 matches found
CVE-2022-1590 Bludit New Content Module new-content cross site scripting
A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input alert1 leads to cross site scripting. The attack can be initiated remotely...
CVE-2022-1590 Bludit New Content Module new-content cross site scripting
A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input alert1 leads to cross site scripting. The attack can be initiated remotely...
CVE-2022-1590
Bludit 3.13.1 is affected by a Cross-Site Scripting vulnerability in the New Content module, exposed via the /admin/new-content endpoint. The issue stems from unsafely handling user-supplied content (example payload: ), enabling client-side script execution. The attack is remotely initiable but r...
Bludit 跨站脚本漏洞
Bludit CMS is an open source lightweight blog content management system CMS. v3.13.1 of Bludit CMS contains a cross-site scripting vulnerability that originates from the lack of filtering and validation of user input data on the /admin/new-content page. An attacker could use this vulnerability to...
USN-5400-2: MySQL vulnerabilities
USN-5400-1 fixed several vulnerabilities in MySQL. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated in...
CVE-2022-28589
A stored cross-site scripting XSS vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=addnew...
CVE-2022-20757
A vulnerability in the connection handling function in Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper traffic handling when platform limits are...
[SECURITY] Fedora 34 Update: vim-8.2.4804-1.fc34
VIM VIsual editor iMproved is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more...
new.9kchina.com Cross Site Scripting vulnerability OBB-2567534
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware
We recently found a new advanced persistent threat APT group that we have dubbed Earth Berberoka aka GamblingPuppet. This APT group targets gambling websites on Windows, macOS, and Linux platforms using old and new malware families...
Important: gzip, xz
Issue Overview: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to...
Remote Code Execution (RCE)
HotelDruid is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization allowing an attacker to insert a maliciously crafted payload into the name field under the Create New Room module...
newzealand.intensjobs.com Cross Site Scripting vulnerability OBB-2553943
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
The vulnerability of the _zip_cdir_new function in the PHP programming language allows a attacker to trigger a service failure or execute arbitrary code.
The vulnerability of the zipcdirnew function in the PHP programming language is related to errors in number processing. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...
Hackers Are Getting Caught Exploiting New Bugs More Than Ever
A pair of reports from Mandiant and Google found a spike in zero-day vulnerabilities in 2021. The question is, why?...
Long Article on NSO Group
Ronan Farrow has a long article in the New Yorker on NSO Group, which includes the news that someone -- probably Spain -- used the software to spy on domestic Catalonian separatists...
newzleand.cliverify.com Cross Site Scripting vulnerability OBB-2531873
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2022-18872 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.6 MediaWiki versions 1.36.x prior to 1.36.4 MediaWiki versions 1.37.x prior to 1.37.2 Description: A denial-of-service issue was discovered in MediaWiki. When many files exist, requesting Special:NewFiles with...
CISO Forum 2022: the first major Russian security conference in the New Reality
Hello everyone! After a two-year break, I took part in Moscow CISO Forum 2022 with a small talk "Malicious open source: the cost of using someone elses code". Alternative video link for Russia: CISO Forum is the first major Russian conference since the beginning of The New Reality of Information...
