11989 matches found
CVE-2024-20931
...
CVE-2024-20927
...
CVE-2024-20919
...
CVE-2024-20907
...
Login as User or Customer <= 3.8 - Admin Account Takeover
Description The plugin does not prevent users to log in as any other user on the site. 1. As an admin, log in as some user. Note the user ID. 2. Run the following curl command, filling in the ADMINID and the USERID: curl -v https://example.com/wp-admin/admin-ajax.php -H 'Cookie:...
CVE-2023-52395
Rejected reason: This is unused...
CVE-2023-43749
Rejected reason: This is unused...
CVE-2023-45738
Rejected reason: This is unused...
Open redirect
Rejected reason: This is unused...
CVE-2024-1216
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Intel Extreme Tuning Utility (XTU) February 2024 Security Update
Intel has informed HP of potential security vulnerabilities in some Intel® Extreme Tuning Utility XTU software, which might allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Intel has released updates to mitigate the potential...
GHSA-2JV5-9R88-3W3P vulnerabilities
Vulnerabilities for packages: reflex...
Why Are Compromised Identities the Nightmare to IR Speed and Efficiency?
Incident response IR is a race against time. You engage your internal or external team because there's enough evidence that something bad is happening, but you're still blind to the scope, the impact, and the root cause. The common set of IR tools and practices provides IR teams with the ability ...
Sql injection
Before Beetl v3.15.12, the rendering template has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading t...
ASB-A-314698313
Bulletin has no description...
Jenkins 2.441 / LTS 2.426.3 Arbitrary File Read
python poc.py usage: python poc.py http://127.0.0.1:8888/ /etc/passwd import threading import http.client import time import uuid import urllib.parse import sys if lensys.argv != 3: print' usage: python poc.py http://127.0.0.1:8888/ /etc/passwd' exit databytes =...
Jenkins cli Ampersand Replacement Arbitrary File Read
This module utilizes the Jenkins cli protocol to run the help command. The cli is accessible with read-only permissions by default, which are all thats required. Jenkins cli utilizes args4j's parseArgument, which calls expandAtFiles to replace any @ with the contents of a file. We are then able t...
TeamViewer Exploited to Obtain Remote Access, Deploy Ransomware
By Deeba Ahmed TeamViewer has been identified as the access point in two separate ransomware attacks targeting different companies. This is a post from HackRead.com Read the original post: TeamViewer Exploited to Obtain Remote Access, Deploy Ransomware...
Cracked software beats gold: new macOS backdoor stealing cryptowallets
A month ago, we discovered some cracked apps circulating on pirating websites and infected with a Trojan proxy. The malicious actors repackaged pre-cracked applications as PKG files with an embedded Trojan proxy and a post-install script initiating the infection. We recently caught sight of a new...