run-down.com Cross Site Scripting vulnerability OBB-3655165

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SUSE CVE-2023-39320

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in its lack of name-based path restrictions. This allows attackers to gain access to confidential information.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to deficiencies in path name restrictions. Exploiting this vulnerability can allow attackers to access confidential information using the runid parameter...

The vulnerability of the “Run Task” function in software for creating, monitoring, and orchestrating data processing scenarios allows attackers to access confidential information.

The vulnerability of the “Run Task” function in software for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to the exposure of protected information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to...

Users are able to front-run settlements to avoid loss

Lines of code Vulnerability details Impact A user is able to front-run the call to settle function in to avoid paying the loss. settle is called by Admin which is a public function, When this functions is called the transaction will appear in the mem pool. A user may then call redeem from LP Vaul...

You can front-run to enrich yourself

Lines of code Vulnerability details Impact An attacker can use flash loan and withdraw significant part of funding intended for collateral providers. Proof of Concept Let's consider code snippet from deposit: requireshares = previewDepositassets != 0, "ZEROSHARES";...

[SECURITY] Fedora 38 Update: exercism-3.2.0-1.fc38

Exercism provides a way to do the problems on https://exercism.io. This CLI ships as a binary with no additional run-time requirements. This mea ns that if you're doing the Haskell problems on exercism you don't need a working Python or Ruby environment simply to fetch and submit exercises...

PT-2023-35991 · Git +1 · Cras

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a use-of-uninitialized-value. The crash occurs in the following functions: dev io capture, dev io run, and audi...

CVE-2023-39652

theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run...

CVE-2023-39652: Improper Neutralization of Special Elements used in an SQL Command

theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run...

AZL-27974 CVE-2023-32559 affecting package nodejs18 for versions less than 18.17.1-2

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsyn...

Design/Logic Flaw

A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit h...

CVE-2023-4448 OpenRapid RapidCMS run-movepass.php password recovery

A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit h...

CVE-2023-4448 OpenRapid RapidCMS run-movepass.php password recovery

A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit h...

CVE-2023-4448: Weak Password Recovery Mechanism for Forgotten Password

A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit h...

PT-2023-27359 · Lenovo · Lenovo Thinkpad

Name of the Vulnerable Software and Affected Versions: Lenovo ThinkPad affected versions not specified Description: A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to...

PT-2023-29005 · Microworld · Microword Escan Antivirus

Name of the Vulnerable Software and Affected Versions: MicroWorld eScan Anti-Virus version 7.0.32 Description: A critical vulnerability was found in MicroWorld eScan Anti-Virus on Linux, affecting an unknown part of the file runasroot. The manipulation leads to incorrect execution-assigned...

GaugeController - Vulnerability with changing gauge weight would make the contract stop working

Lines of code Vulnerability details Impact The issue is applied differently based on how changegaugeweight works. 1. When changing gauge weight is essential for every enabled gauge before any vote happens An attacker can front-run changegaugeweight transaction to manipulate slope which can result...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Aug 2023)

This host is missing a critical security update according to Microsoft Office Click-to-Run update August 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier...

PT-2023-23334 · Prtg · Prtg

Name of the Vulnerable Software and Affected Versions: PRTG versions 23.2.84.1566 and earlier Description: A path traversal vulnerability was identified in the WMI Custom sensor where an authenticated user with write permissions could trick the sensor into behaving differently for existing files...