Researchers Uncover Publisher Spoofing Bug in Microsoft Visual Studio Installer

Security researchers have warned about an "easily exploitable" flaw in the Microsoft Visual Studio installer that could be abused by a malicious actor to impersonate a legitimate publisher and distribute malicious extensions. "A threat actor could impersonate a popular publisher and issue a...

CVE-2023-31200

PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack...

CVE-2023-31200

PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack...

CVE-2023-31200 PTC Vuforia Studio Cross-Site Request Forgery

PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack...

CVE-2023-31200 PTC Vuforia Studio Cross-Site Request Forgery

PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack...

CVE-2023-31200

PTC Vuforia Studio contains a Cross-Site Request Forgery vulnerability (CVE-2023-31200): the local web app does not require a token, enabling an attacker with local access to perform CSRF or replay attacks. Affected products include Vuforia Studio prior to version 9.9. Mitigation recommended by t...

CVE-2023-29502 PTC Vuforia Studio Path Traversal

Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path...

CVE-2023-29502 PTC Vuforia Studio Path Traversal

Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path...

CVE-2023-27881 PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881 PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-29152 PTC Vuforia Studio Improper Authorization

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

CVE-2023-29152 PTC Vuforia Studio Improper Authorization

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

CVE-2023-24476 PTC Vuforia Studio Improper Authorization

An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid...

CVE-2023-24476 PTC Vuforia Studio Improper Authorization

An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid...

CVE-2023-29168 PTC Vuforia Studio Insufficiently Protected Credentials

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

CVE-2023-29168 PTC Vuforia Studio Insufficiently Protected Credentials

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

Nidhogg - All-In-One Simple To Use Rootkit For Red Teams

Nidhogg is a multi-functional rootkit for red teams. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for red team engagements that can be integrated with your C2 framework via a single header file with simple usage, you can see an...

CVE-2022-36243

Shop Beat Solutions pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2....

Wave Studio Animated Keyboard Emoji 安全漏洞

Wave Studio Animated Keyboard Emoji is an animated keyboard emoji application from Wave Studio, Inc. A security vulnerability exists in Wave Studio Animated Keyboard Emoji version v.1.70.7 that stems from the presence of a denial of service attack...

PT-2023-13462 · Shop Beat Solutions · Shop Beat Studio +1

Name of the Vulnerable Software and Affected Versions: Shop Beat Media Player versions 2.5.95 through 3.2.57 Shop Beat studio versions prior to 3.2.57 Description: The issue affects Shop Beat Solutions, specifically the Shop Beat Media Player and Shop Beat studio software. It is related to a...