CVE-2023-25573

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

Improper access control

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-25814

Vulnerability overview (CVE-2023-25814) : metersphere prior to 2.7.1 allows a user with UI-created resource file permission to append a path to their submission query, which is then read and displayed by the system, enabling read access to arbitrary server filesystem files if the server process h...

CVE-2023-25573

Metersphere contains an improper access control vulnerability: unauthenticated users can download arbitrary files via /api/jmeter/download/files, exposing sensitive data. Affected versions include those prior to the fixes, with remediation in versions 1.20.20 lts and 2.7.1. The issue stems from i...

Sourcecodester COVID 19 Testing Management System SQL注入漏洞

Sourcecodester COVID 19 Testing Management System is a web-based application that provides an online platform for personal and Covid test administration to manage individual testing processes and results. A SQL injection vulnerability exists in SourceCodester COVID 19 Testing Management System...

PT-2023-16872 · Sourcecodester · Sourcecodester Covid 19 Testing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A critical issue was found in the COVID 19 Testing Management System, affecting an unknown functionality of the patient-report.php file, specifically in the POST...

The US Air Force Is Moving Fast on AI-Piloted Fighter Jets

After successful autonomous flight tests in December, the military is ramping up its plans to bring artificial intelligence to the skies...

Debian: Security Advisory (DSA-2104-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

This Week in Spring - March 7th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's an amazing week, and this week we've got a lot to look at. Let's dive right into it. Spring Cloud Function for Azure Function Spring Data 2022.0.3 and 2021.2.9 released Spring R2DBC for Reactive Relational Databases in...

CVE-2022-3857

Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested...

Purchase Order Management 1.0 Cross Site Scripting

Title: Purchase Order Management-1.0 - XSS-Reflected - Information-gathering Author: nu11secur1ty Date: 03.06.2023 Vendor: https://www.sourcecodester.com/user/257130/activity Software: https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html...

Exploit for Double Free in Linux Linux_Kernel

This is a repository containing a proof-of-concept PoC exploit for a vulnerability in a Linux kernel module. The PoC is for CVE-2021-22600, a vulnerability in the Linux kernel's packet socket implementation that allows an attacker to bypass certain security restrictions. The exploit is implemente...

The vulnerability of the System Management Unit (SMU) component of AMD processors allows a hacker to trigger a service failure.

The vulnerability of the System Management Unit SMU component of AMD processors exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

DNA testing service to pay $400k for data breach it ignored

By Habiba Rashid DNA Diagnostics Center DDC, a US-based DNA testing service suffered a data breach in November 2021, in which… This is a post from HackRead.com Read the original post: DNA testing service to pay $400k for data breach it ignored...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2023-21839 Using this project to attack or test target...

Experts Sound Alarm Over Growing Attacks Exploiting Zoho ManageEngine Products

Multiple threat actors have been observed opportunistically weaponizing a now-patched critical security vulnerability impacting several Zoho ManageEngine products since January 20, 2023. Tracked as CVE-2022-47966 CVSS score: 9.8, the remote code execution flaw allows a complete takeover of the...

com.adobe.aem:aem-sdk-api (=2020.6.3800.20200626T210738Z-200604), com.adobe.cq:core.wcm.components.testing.aem-mock-plugin (>=2.17.10 <=2.24.6) +113 more potentially affected by CVE-2023-25621 via org.apache.sling:org.apache.sling.i18n (>=2.0.2 <=2.5.6)

org.apache.sling:org.apache.sling.i18n MAVEN version =2.0.2, =2.17.10, =0.0.10, =1.0, =5.5.4, =5.6.2 and more Source cves: CVE-2023-25621 Source advisory: OSV:GHSA-MRPV-5PMR-P92H...

K31085564: Spectre SWAPGS gadget vulnerability CVE-2019-1125

Security Advisory Description An information disclosure vulnerability exists when certain central processing units CPU speculatively access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073. CVE-2019-1125 also known as Spect...

American Fuzzy Lop plus plus 安全漏洞

American Fuzzy Lop plus plus AFL++ is is an advanced branch of Google's AFL - faster, more and better mutations, more and better instrumentation, custom module support, and more. AFL++ 4.05c contains a security vulnerability that originates in the CmpLog component that uses the current working...

PT-2023-1915 · Zyxel · Zyxel Lte3316-M604 +1

Name of the Vulnerable Software and Affected Versions: Zyxel LTE3316-M604 version V2.00ABMP.6C0 Zyxel LTE3202-M437 affected versions not specified Description: A security misconfiguration vulnerability exists due to a factory default misconfiguration intended for testing purposes. This allows a...