HPESBHF04742 rev.1 - Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01079, Intel Xeon Processor with Intel SGX Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1470 Storage - Prior to 2.3008-09-2024 HPE StoreEasy 1470 Performance - Prior to 2.3008-09-2024 HPE StoreEasy 1570 Storage - Prior to 2.3008-09-2024 HPE StoreEas...

PT-2024-39960 · WordPress · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress Pro plugin for WordPress versions up to, and including, 4.11.1 Description: The issue is due to insufficient verification on the user being returned by the social login token, allowing unauthenticated attackers to log in as any...

SUSE CVE-2022-49005

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for sx controls For sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in sndsocputvolswsx needs to jus...

PT-2024-16027 · Unknown · Binary-Husky/Gpt Academic

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: A path traversal vulnerability exists due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Resty package for Golang Go (CVE-2023-45286).

Summary The HTTP and REST client library used in Golang Go by the IBM Storage Protect Server is vulnerable to potential exposure of sensitive information from the host system. This bulletin provides steps to mitigate these vulnerabilities. Vulnerability Details CVEID:CVE-2023-45286 DESCRIPTION: G...

Vivo Fibra Askey RTF8225VW Command Execution

--- Exploit 1 Documentation on the Vivo Fibra Modem Exploit I discovered an exploit that allows access to the sh shell on the Vivo Fibra modem. This method essentially involves terminating the aspsh shell and invoking sh using the output of cat /dev/null. Using the pipe | is crucial for this...

Malicious code in code-script-new-viking-simulator-script-hm9gi2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 058793c63bd85edadc62fdaf3684566ed1bc0687f28f5d5f36b5f5d3cb1ca680 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-43363

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process completing only step 5 of the installation process is enough, no need to complete the steps before or after it to...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control due to the UI upgrade process. An attacker can access the version number or execute parts of the upgrade process without proper permissions. Note: As upgrading in the user interface is deprecated, this...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control due to the UI upgrade process. An attacker can access the version number or execute parts of the upgrade process without proper permissions. Note: As upgrading in the user interface is deprecated, this...

PT-2024-31809 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.3.2.0 and newer Description: The issue concerns the deserialization of untrusted data in the MindsDB platform. This allows a maliciously uploaded model to run arbitrary code on the server when interacted with...

Exploit for Code Injection in Sqlpad

CVE-2022-0944: Privilege Escalation Vulnerability in OverlayFS...

CVE-2024-6979

CVE-2024-6979 affects Axis OS, where a broken access control could allow less-privileged operator- and/or viewer-accounts to gain higher privileges. The issue is described as requiring complex steps and social engineering to trigger administrator configurations, with exploitation risk considered ...

PT-2024-29939 · Dell · Dell Precision Rack

Name of the Vulnerable Software and Affected Versions: Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2 Description: The issue is related to an Improper Input Validation vulnerability. A high-privileged attacker with local access could potentially exploit this vulnerability, leading t...

Helpdeskz 2.0.2 Cross Site Scripting

Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...

Network restriction bypass via race condition during namespace termination

CVSS Rating: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Low 3.1 A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace...

Microweber 2.0.15 Cross Site Scripting Vulnerability

Microweber version 1.0 suffers from a cross site scripting vulnerability in the search functionality. Original discovery of cross site scripting in this version is attributed to tmrswrr in June of 2024. Exploit Title: Microweber =v2.0.15 - Reflected Cross-Site Scripting XSS Exploit Author: Prerak...

Details Matter: Pentesting a single device to guarantee security

Rapid7’s penetration testing services regularly assess internal networks of various sizes. For this particular engagement, however, Rapid7 was tasked with performing a penetration test of just one device on an internal network. The device was being piloted for future deployment and the customer h...

INTERPOL Recovers $41 Million in Largest Ever BEC Scam in Singapore

INTERPOL said it devised a "global stop-payment mechanism" that helped facilitate the largest-ever recovery of funds defrauded in a business email compromise BEC scam. The development comes after an unnamed commodity firm based in Singapore fell victim to a BEC scam in mid-July 2024. It refers to...

Microweber 2.0.15 Cross Site Scripting

Exploit Title: Microweber =v2.0.15 - Reflected Cross-Site Scripting XSS Date: 16.07.2024 Exploit Author: Prerak Mittal Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber/releases/tag/v2.0.15 Version: =v2.0.15 Tested on: Ubuntu 22.04 CVE : CVE-2024-401...