CVE-2024-1705

CVE-2024-1705 affects Shopwind up to version 4.6. The vulnerability is in the Installation component, specifically the actionCreate function of /public/install/controllers/DefaultController.php, allowing code injection. Impact is remote execution with high severity; exploitation is reported as kn...

Cross site scripting

Reflected cross-site scripting XSS vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected in...

CVE-2023-40191

CVE-2023-40191 – Reflected XSS in Liferay Portal/DXP: The vulnerability affects Liferay Portal 7.4.3.44–7.4.3.97 and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44–92. It allows remote attackers to inject arbitrary web script or HTML via the Blocked Email Domains field in Accounts > ins...

CVE-2024-25601

CVE-2024-25601 affects the Expando module geolocation custom fields in Liferay Portal 7.2.0–7.4.2 and older unsupported versions, and Liferay DXP 7.3 before SP3, 7.2 before FP17. It is a stored XSS vulnerability allowing remote authenticated users to inject arbitrary web script or HTML via the na...

CVE-2024-25602

Summary (CVE-2024-25602) Stored cross-site scripting (XSS) vulnerability in the Users Admin module’s edit user page of Liferay Portal (7.2.0–7.4.2) and Liferay DXP (7.3 before SP3, 7.2 before fix pack 17; older unsupported versions). An authenticated remote user can inject arbitrary web script or...

PT-2024-18238 · Shopwind · Shopwind

Name of the Vulnerable Software and Affected Versions: Shopwind versions up to 4.6 Description: A critical issue affects the actionCreate function of the /public/install/controllers/DefaultController.php file in the Installation component, leading to code injection. The attack can be initiated...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability arises due to the failure to take measures to eliminate special elements within the platform, allowing attackers to inject arbitrary code.

The vulnerability of the XWiki platform lies in its lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...

CVE-2024-22936

CVE-2024-22936 affects Genesis AIMS Student Information Systems (Genesis SIS) v.3053, specifically the Parents & Student Portal where the message parameter is vulnerable to cross-site scripting (XSS). The underlying issue is improper handling of the message input, allowing remote attackers to inj...

Code injection

A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /application/index/controller/Screen.php. The manipulation of the argument fileurl leads to code injection. The attack can be launched remotely. The...

USN-6592-1 libssh vulnerabilities

It was discovered that libssh incorrectly handled the ProxyCommand and the ProxyJump features. A remote attacker could possibly use this issue to inject malicious code into the command of the features mentioned through the hostname parameter. CVE-2023-6004 It was discovered that libssh incorrectl...

Cross site scripting

A Cross-site scripting XSS vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part...

Attacks, Vulnerabilities and Actors 1 January to 7 January 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of twelve executed attacks, two instances of adversary activity, and three exploited...

Ivanti Addresses Critical Vulnerability in Endpoint Manager

Summary: Ivanti addressed a critical vulnerability CVE-2023-39336 in its Endpoint Management software, ensuring secure usage for its 40,000 worldwide customers. The flaw, resolved in version 2022 Service Update 5, posed a risk of pre-authenticated sql injection and possibly Remote Code Injection ...

QNAP Systems QuMagie Cross-Site Scripting Vulnerability

QNAP Systems QuMagie is a QTS photo management application from QNAP Systems. A cross-site scripting vulnerability exists in QNAP Systems QuMagie prior to version 2.2.1, which stems from the presence of a cross-site scripting XSS vulnerability that could allow an authenticated user to inject...

CVE-2024-0196

A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resource/file/api/save?auto=1. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed ...

CVE-2024-0196

CVE-2024-0196 (Magic-Api) affects Magic-Api versions up to 2.0.1. The vulnerability is a code injection in an unknown functionality exposed via the HTTP endpoint /resource/file/api/save?auto=1, which can be exploited remotely. Multiple connected sources confirm code execution risk and public disc...

PT-2024-15379 · Ai Magic · Ai Magic

Name of the Vulnerable Software and Affected Versions: Magic-Api versions up to 2.0.1 Description: A critical vulnerability has been found in Magic-Api, affecting an unknown functionality of the file "/resource/file/api/save?auto=1". The manipulation leads to code injection, and the attack can be...

libssh Security Vulnerabilities

libssh is a C development package for accessing SSH services from the libssh organization, which is capable of executing remote commands, file transfers, as well as providing a secure transport channel for remote programs. A security vulnerability exists in libssh version 0.10.x, version 0.9.x, a...

Code injection

A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. The...

CVE-2023-6851 kalcaddle KodExplorer ZIP Archive app.php unzipList code injection

A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. The...