Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware

WAGO-CVE-2023-1698 WAGO系统远程代码执行漏洞CVE-2023-1698 Attention...

LinkedIn: Html injection in event Description

A vulnerability was found where HTML injection was possible in event descriptions on LinkedIn, allowing malicious links to be inserted and executed when users viewed search results. By adding a link with HTML markup as an event description and making the event public, the link would execute for...

Exploit for Improper Check for Unusual or Exceptional Conditions in Apple Ipados

CVE-2023-41993 PoC exploit for CVE-2023-41993. It's written o...

Store XSS when Add Reviewer

Description Store XSS when Add Reviewer Proof of Concept Payload: TESTalertdocument.domain Video Poc https://drive.google.com/file/d/16o4w6V-uCpkshFXYBb-pZRflpl7N3Sy4/view?usp=sharing...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

xortigate-cve-2023-27997 Exploit for xortigate CVE-2023-2799...

CISA Warns of Actively Exploited Adobe Acrobat Reader Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added a high-severity flaw in Adobe Acrobat Reader to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. Tracked as CVE-2023-21608 CVSS score: 7.8, the vulnerability has been described ...

Exploit for Uncontrolled Resource Consumption in Ietf Http

This is a proof of concept for a Denial of Service DoS exploit...

Coppermine Gallery 1.6.25 Remote Code Execution

Exploit Title: coppermine-gallery 1.6.25 RCE Application: coppermine-gallery Version: v1.6.25 Bugs: RCE Technology: PHP Vendor URL: https://coppermine-gallery.net/ Software Link: https://github.com/coppermine-gallery/cpg1.6.x/archive/refs/tags/v1.6.25.zip Date of found: 05.09.2023 Author: Mirabba...

Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)

--------------------------------------------------------- Title: Microsoft Windows 11 - 'apds.dll' DLL hijacking Forced Date: 2023-09-01 Author: Moein Shahabi Vendor: https://www.microsoft.com Version: Windows 11 Pro 10.0.22621 Tested on: Windows 11x64 eng...

Webedition CMS v2.9.8.8 - Blind SSRF

Exploit Title: Webedition CMS v2.9.8.8 - Blind SSRF Application: Webedition CMS Version: v2.9.8.8 Bugs: Blind SSRF Technology: PHP Vendor URL: https://www.webedition.org/ Software Link: https://download.webedition.org/releases/OnlineInstaller.tgz?p=1 Date of found: 07.09.2023 Author: Mirabbas...

CSRF in Send Reminder

Description CSRF in Send Reminder Proof of Concept 1 .Attacker sent form fake to victim history.pushState'', '', '/'; document.forms0.submit; 2 .Victim click, execute send reminder unexpected Video Poc https://drive.google.com/file/d/1eibfxIbACA6DWObg2bjZjJBiqTPlwWd/view?usp=sharing...

Race condition on timeWeightedWeeklyGlobalConcLiquidityLastSet_ can lead to incorrect rewards.

Lines of code Vulnerability details Impact timeWeightedWeeklyGlobalConcLiquidityLastSet is read and written in multiple functions. If two transactions call at similar times, the state updates could overwrite each other. The timeWeightedWeeklyGlobalConcLiquidityLastSet state variable is used in...

Exploit for Improper Restriction of XML External Entity Reference in Dogtagpki

CVE-2022-2414 CVE-2022-24...

MAL-2023-8290 Malicious code in poc-nvk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10eb10880328aea55a7c7620d283f145ebcb574bfc98567eef9ad44d1ee8fcdb The OpenSSF Package Analysis project identified 'poc-nvk' @ 0.1.2 pypi as malicious. It is considered malicious because: - The package...

Malicious code in poc-nvk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10eb10880328aea55a7c7620d283f145ebcb574bfc98567eef9ad44d1ee8fcdb The OpenSSF Package Analysis project identified 'poc-nvk' @ 0.1.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8289 Malicious code in nvkvictim-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d0c415815934e3c66b707f8613100479590a1afe4a29fc46c607999157536e2 The OpenSSF Package Analysis project identified 'nvkvictim-poc' @ 0.1 pypi as malicious. It is considered malicious because: - The package...

Malicious code in nvkvictim-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d0c415815934e3c66b707f8613100479590a1afe4a29fc46c607999157536e2 The OpenSSF Package Analysis project identified 'nvkvictim-poc' @ 0.1 pypi as malicious. It is considered malicious because: - The package...

Presto JDBC Server-Side Request Forgery by nextUri

Summary Presto JDBC is vulnerable to Server-Side Request Forgery SSRF when connecting a remote Presto server. An attacker can modify the nextUri parameter to internal server in response content that Presto JDBC client will request next and view sensitive information from highly sensitive internal...

Presto JDBC Server-Side Request Forgery by redirect

Summary Presto JDBC is vulnerable to Server-Side Request Forgery SSRF when connecting a remote Presto server. An attacker can construct a redirect response that Presto JDBC client will follow and view sensitive information from highly sensitive internal servers or perform a local port scan. Detai...

U.S. Dept Of Defense: Subdomain Takeover via Host Header Injection on www.█████

The vulnerability was a subdomain takeover due to a CNAME record pointing to an unclaimed domain. This allowed malicious individuals to potentially take control of the affected subdomain and use it for malicious purposes...