Grav Server Side Template Injection (SSTI) vulnerability

Summary I found an RCERemote Code Execution by SSTI in the admin screen. Details Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. PoC 1. Log in to the administrator screen and access the edit screen of the defaul...

Design/Logic Flaw

Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources...

CVE-2023-34154

CVE-2023-34154 affects Huawei HarmonyOS’ VR screen projection component. The vulnerability is described as undefined/ improper permissions that allow third‑party apps to create windows arbitrarily, leading to resource consumption (availability impact). CVSSv3.1 base score 8.2 (HIGH) with network ...

CVE-2023-34154

Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources...

PT-2023-24696 · Huawei · Huawei Vr Screen Projection

Name of the Vulnerable Software and Affected Versions: HUAWEI VR screen projection affected versions not specified Description: The issue concerns undefined permissions in HUAWEI VR screen projection, allowing third-party apps to create windows in an arbitrary manner and consume system resources...

CVE-2023-21095

In canStartSystemGesture of RecentsAnimationDeviceState.java, there is a possible partial lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

screenmediafilms.net Cross Site Scripting vulnerability OBB-3434137

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-17920 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: The issue is related to a possible activity launch while the app is in the background due to a BAL bypass in the getFullScreenIntentDecision method of...

PT-2023-5280 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a logic error in the code of HostEmulationManager.java, specifically in the onHostEmulationData function. This error allows a general-purpose NFC reader to read the...

CVE-2023-34251

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

Design/Logic Flaw

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

CVE-2023-34251 Grav Server Side Template Injection vulnerability

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

CVE-2023-34251 Grav Server Side Template Injection vulnerability

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

Grav 代码注入漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A code injection vulnerability exists in Grav versions prior to 1.7.42, which stems from the presence of a server-side template injection SSTI vulnerability...

CLSA-2023-1686651204 kernel: Fix of 25 CVEs

cgroup: Use open-time cgroup namespace for process migration perm checks CVE-2021-4197 - cgroup: Use open-time credentials for process migraton perm checks CVE-2021-4197 - vt: drop old FONT ioctls CVE-2021-33656 - fbmem: Check virtual screen sizes in fbsetvar CVE-2021-33655 - fbcon: Prevent that...

CLSA-2023-1686585068 kernel: Fix of 26 CVEs

cgroup: Use open-time cgroup namespace for process migration perm checks CVE-2021-4197 - cgroup: Use open-time credentials for process migraton perm checks CVE-2021-4197 - cgroup: cgroup.procs,threads factor out common parts - cgroup: unify attach permission checking - vt: drop old FONT ioctls...

Stealth Soldier: A New Custom Backdoor Targets North Africa with Espionage Attacks

A new custom backdoor dubbed Stealth Soldier has been deployed as part of a set of highly-targeted espionage attacks in North Africa. "Stealth Soldier malware is an undocumented backdoor that primarily operates surveillance functions such as file exfiltration, screen and microphone recording,...

The vulnerability of the Telegram Messenger messaging application for the macOS operating system, related to access control deficiencies, allows a hacker to gain access to files with restricted access, the microphone, and screen recordings.

The vulnerability of the Telegram Messenger messaging app is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to files with restricted access, as well as the microphone...

The Console Does Not Appear After Being Launched

Challenge After launching the Veeam Backup & Replication Console, the splash screen appears, and the application is shown in the taskbar, but the Console does not appear, and the mouseover preview is blank. Cause The Console's window position is off the edge of the screen. When the Veeam Backup &...

Over 60K Adware Apps Posing as Cracked Versions of Popular Apps Target Android Devices

Thousands of adware apps for Android have been found to masquerade as cracks or modded versions of popular applications to serve unwanted ads to users as part of a campaign ongoing since October 2022. "The campaign is designed to aggressively push adware to Android devices with the purpose to dri...