422 matches found
CVE-2023-23397
CVE-2023-23397 PoC semplice e rozzo della vulnerabilità CVE-2023-23397 che impatta il client desktop di Outlook. Descrizione Outlook soffre di una mancanza di controllo sull'input dell'utente che consente di configurare il suono dei promemoria di riunioni e appuntamenti. Un attaccante può infatti...
cve-2023-23397
CVE-2023-23397 Este script permite criar e-mails do Outlook codificados em TNEF com o payload de exploração do CVE-2023-23397 e enviá-los via SMTP puro - sem necessidade de objetos COM ou EWS. Não consegui fazer com que a classe de mensagem IPM.Schedule.Meeting.Request funcionasse corretamente el...
CVE-2023-31705
CVE-2023-31705 descrição Uma vulnerabilidade de Cross-site scripting XSS Refletido no Sourcecodester Task Reminder System 1.0 permite que um usuário autenticado injete javascript malicioso no parâmetro page. Tipo de Vulnerabilidade Cross Site Scripting XSS Fornecedor do Produto Sourcecodster Base...
CVE-2023-23397-POC
Dois POCs que criei para a vulnerabilidade NTLM CVE-2023-23397. Originalmente, os POCs enviavam solicitações de reunião com um lembrete, mas consegui enviar um e-mail com um lembrete que não exigia interação do usuário. O arquivo .ps1 precisa ser executado a partir de um host Windows comprometido...
GHSA-652Q-GVQ3-74QV n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...
GHSA-4VPF-W7QV-5H3Q MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Unvalidated notetype Parameter in mcissueupdate SOAP Endpoint Allows creation of TIMETRACKING and REMINDER Notes. The SOAP path passes the user-supplied notetype integer directly to bugnoteadd without validating that the user is authorized to create that type of note. If the user's access level i...
CVE-2026-61344
The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication...
EUVD-2026-42663
The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication...
CVE-2026-61344 Superior Court of California Hearing Reminder Service unauthenticated information disclosure
The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication...
CVE-2026-61344
CVE-2026-61344 affects the Superior Court of California Hearing Reminder Service (hrs.courts.ca.gov). The API endpoint exposes court reminder records containing potentially sensitive information without authentication, indicating an unauthenticated information disclosure. The root cause is an exp...
CVE-2026-61344
The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containing potentially sensitive information without authentication...
Superior Court of California Hearing Reminder Service unauthenticated information disclosure
RISK EVALUATION The Hearing Reminder Service for the Superior Court of California at https://www.hrs.courts.ca.gov exposes an API endpoint that returns sensitive court reminder records without authentication. 2. RECOMMENDED PRACTICES Fixed April 28th, 2026. 3. DESCRIPTION The Superior Court of...
Origin Validation Error
Overview Affected versions of this package are vulnerable to Origin Validation Error via the CORS origin validation process. An attacker can gain unauthorized access to sensitive data by crafting a subdomain that encodes their own workspace UUID and a victim's username, then tricking an...
CVE-2026-53908
MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differences to enumerate valid usernames and...
CVE-2026-53908
CVE-2026-53908 affects MCO. The vulnerability enables user enumeration via authentication-related functions: username reminder and password reset responses differ for valid vs invalid users, allowing an attacker to discover valid usernames and email addresses. Vulnerable context: confirmed in ver...
PT-2026-54834
Name of the Vulnerable Software and Affected Versions MCO version 25.3.3.1 Description The application is susceptible to user enumeration via authentication-related features. During password reset and username reminder operations, the system provides different responses depending on whether the...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...
CVE-2026-47171
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing...
EUVD-2026-36299
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing...