Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context

Related issue & discussion: - https://github.com/ArchiveBox/ArchiveBox/issues/239 - https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overviewpublishing - https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archivesecurity-concerns Impact Any users who save untrusted URLs and view...

GHSA-CR45-98W9-GWQX Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context

Related issue & discussion: - https://github.com/ArchiveBox/ArchiveBox/issues/239 - https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overviewpublishing - https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archivesecurity-concerns Impact Any users who save untrusted URLs and view...

CVE-2023-31046

A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...

Path traversal

A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...

CVE-2023-27795

An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key...

CVE-2023-27795

An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key...

PT-2023-29705

Name of the Vulnerable Software and Affected Versions ArchiveBox affected versions not specified Description The issue affects users of the wget extractor who view the content it outputs. If a user is logged in to the ArchiveBox admin site in the same browser session and views an archived malicio...

CVE-2023-30132

The CVE-2023-30132 vulnerability affects IXP Data EasyInstall 6.6.14907.0 and enables privilege escalation through a static cryptographic key, per multiple sources (NVD, Red Hat, CVE listings, CNNVD, etc.). The root cause is described as a cryptographic key issue that allows an attacker to escala...

Cisco Emergency Responder Trust Management Issues Vulnerability

Cisco Emergency Responder is an emergency response framework from Cisco USA. A trust management issue vulnerability exists in Cisco Emergency Responder version 12.51SU4, which arises from the presence of static user credentials for the root account, which are typically used during development, an...

The vulnerability of the SetHostIPv6StaticSettings() function in the wireless signal booster software D-Link DAP-1325 allows a hacker to execute arbitrary code.

The vulnerability of the SetHostIPv6StaticSettings function in the D-Link DAP-1325 wireless signal booster software is related to the escape of the operation outside the buffer in memory when processing the StaticPrefixLength parameter. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the SetHostIPv6StaticSettings() function in the wireless signal booster software D-Link DAP-1325 allows a hacker to execute arbitrary code.

The vulnerability of the SetHostIPv6StaticSettings function in the D-Link DAP-1325 wireless signal booster software is related to the escape of the operation outside the buffer in memory when processing the StaticDNS1 parameter. Exploiting this vulnerability allows a remote attacker to execute...

Caracal - Static Analyzer For Starknet Smart Contracts

Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries Precompiled...

Path Traversal

static-server is vulnerable to Path Traversal. The vulnerability exists because the library does not properly validate file paths in server.js, allowing an attacker to access files outside the expected directory and read arbitrary files through the relative path such as \..\filename...

Analysis and Config Extraction of Lu0Bot, a Node.js Malware with Considerable Capabilities

Nowadays, more malware developers are using unconventional programming languages to bypass advanced detection systems. The Node.js malware Lu0Bot is a testament to this trend. By targeting a platform-agnostic runtime environment common in modern web apps and employing multi-layer obfuscation,...

CVE-2023-20101

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for th...

Design/Logic Flaw

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for th...

CVE-2023-20101

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for th...

CVE-2023-20101

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for th...

CVE-2023-20101

Cisco Emergency Responder is affected by a vulnerability where an unauthenticated attacker can log in via the root account that uses default, static credentials. The issue comes from static root credentials that cannot be changed or deleted, enabling the attacker to log in and execute arbitrary c...

Cisco Emergency Responder Static Credentials Vulnerability

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for th...