CVE-2023-7080 Arbitrary remote code execution within wrangler dev Workers sandbox

The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run arbitrary cod...

Hail Security Vulnerability

Hail is a Python-based open source general purpose data analysis tool with additional data types and methods for working with genomic data. A security vulnerability exists in versions prior to Hail 0.2.127 that stems from the fact that Hail relies on the OpenID Connect OIDC email address in the I...

CVE-2023-50267

MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds...

How to Manage Your Security Risks

Deciphering the Criticality of Safeguarding Against Security Threats As digital natives, we are well aware that the urgency and importance of ensuring digital safety can't be minimized. The escalating vector of sophisticated digital attacks has brandished a double-edged sword, threatening both...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

Proof Of Concept of SSRF on Request-Baskets CVE-2023-27163...

Exploit for Improper Control of Dynamically-Managed Code Resources in Crushftp

CVE-2023-43177 CrushFTP &l...

Denial Of Service

gitlab:sid is vulnerable to denial of service. the vulnerability due to importing or cloning malicious content. It allows an attacker influence the amount of resources consumed, eventually leading to the exhaustion of available resources...

Denial Of Service

gitlab:sid is vulnerable to denial of service. The vulnerability due to importing or cloning malicious content while authentication. it allow an attacker to exhaustion of available resources which leads to denial of service...

Security feature bypass

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

CVE-2023-48291 Apache Airflow: Improper access control to DAG resources

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

PT-2023-8378 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.8.0 Description: The issue allows an authenticated user with limited access to some DAGs to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.8.0,...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

basketcraft this is a script that exploits the CVE-2023-27163...

NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the saveNodeLabel method. The issue results from the lack o...

CVE-2023-6929

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the...

CVE-2023-6929

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the...

Authorization

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorization, access the hidden resources on the...

CVE-2023-6929

EuroTel ETL3100, affected versions v01c01 and v01x37, suffer from insecure direct object references (IDOR) that allow bypassing authorization by using user-supplied input to access objects. The root cause is improper access control via direct object access, enabling attackers to reach hidden reso...

PKCE Downgrade Attack

yiisoft/yii2-authclient is vulnerable to PKCE Downgrade Attack. The vulnerability is caused due to an insecure implementation of PKCE. The application doesn't use authCodeVerifier securely. An attacker can gain unauthorized access to protected resources by exploiting this vulnerability...

EuroTel ETL3100 Security Vulnerability

The EuroTel ETL3100 is a radio transmitter from EuroTel. A security vulnerability exists in the EuroTel ETL3100 v01c01 version and v01x37 version that originates from a vulnerability that allows an attacker to bypass authorization, access hidden resources on the system, and perform privileged...