Find-WSUS

🧭 Find-WSUS Discover WSUS server configurations across Group Policy Objects GPOs — including hidden Group Policy Preferences GPP. Find-WSUS is a PowerShell script designed for security professionals and system administrators to identify all WSUS Windows Server Update Services server URLs configur...

RosarioSIS 6.7.2 - Cross-Site Scripting

RosarioSIS version 6.7.2 and earlier contains a reflected cross-site scripting XSS vulnerability in the Preferences module. The 'tab' parameter in Modules.php is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code via a crafted URL. id: CVE-2020-15718 info: name:...

Malware in @grabcad/preferences-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @grabcad/preferences-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c846a3e9766d663572fb4d716588823020e219af5c1fb75793661c5c87627ba5 The package presents itself as a 'Compatibility shim' under the @grabcad scope and exports a Proxy that returns no-op functions for any property...

GPOCrack

GPOCRACK.py Active Directory Group Policy Preferences cpassword cracker/decrypter. How to use python2 gpocrack.py cGc4817iMQclr1Ssixv35UpaH/FXy+1s5FnM2RqD4BI...

CVE-2026-113610

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113610

Xen Orchestra versions prior to 6.9.0 are vulnerable to an authorization bypass within the xo-server user.set API method. This flaw allows low-privileged authenticated users to modify the preferences of other users by providing an arbitrary target user ID. Consequences include the ability to dele...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

EUVD-2026-105088

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2022-4556

CVE-2022-4556 - Stored XSS in SOGo Webmail v5.7.1 🧠 Summary A Stored Cross-Site Scripting XSS vulnerability was discovered in the fullName field of the Identity Preferences section in the SOGo web interface , affecting version 5.7.1. An authenticated attacker could inject a malicious script that...

CVE-2026-65372

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences...

CVE-2026-65372

A race condition vulnerability exists in macOS systems, where a malicious application may be able to bypass Privacy preferences . The root cause involves improper synchronization during concurrent execution. This issue has been addressed with additional validation and is fixed in macOS Golden Gat...

CVE-2026-65372

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences...

EUVD-2026-104700

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences...

CVE-2020-36287

CVE-2020-36287 The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions chec...

CVE-2026-67234

A flaw was found in rabbitmq-server. When clearing authentication preferences, the server generates a non-compliant cookie name containing invalid characters that standard web browsers reject when attempting deletion. This issue prevents the browser from properly removing the cookie, allowing sta...

firefox security update

140.17.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 140.17.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.17.0-1 - Update to 140.17.0 ESR...

CVE-2026-100804

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Preferences: Backend component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

RabbitMQ 4.2.x < 4.2.8 / 4.3.x < 4.3.2 Non-RFC-Conformant Auth Mechanism Cookie Name

The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.8, or 4.3.x prior to 4.3.2. It is, therefore, affected by a vulnerability: - getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producin...