Total CMS 1.7.4 Shell Upload

Exploit Title: Total CMS 1.7.4 - Remote Code Execution RCE on File Upload Authenticated Date: 03/06/2023 Exploit Author: tmrswrr Version: 1.7.4 Vendor home page : https://www.totalcms.co/ Tested Url : https://www.totalcms.co/demo/soccer/ PLatform : MACOSX 1 Go to this page and click edit page...

RomCom RAT Using Deceptive Web of Rogue Software Sites for Covert Attacks

The threat actors behind RomCom RAT are leveraging a network of fake websites advertising rogue versions of popular software at least since July 2022 to infiltrate targets. Cybersecurity firm Trend Micro is tracking the activity cluster under the name Void Rabisu, which is also known as Tropical...

Vulnerability fixed in BitDefender

BitDefender has fixed a vulnerability in Bitdefender Total Security, Bitdefender Internet Security and Bitdefender Antivirus Plus. A malicious person could exploit the vulnerability to grant themselves granted elevated privileges and potentially execute arbitrary code execute arbitrary code with...

Path traversal

Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to...

CVE-2022-0357 Improper Quoting Path Issue in Bitdefender Total Security

Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to...

CVE-2022-0357 Improper Quoting Path Issue in Bitdefender Total Security

Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to...

CVE-2022-0357

CVE-2022-0357 is an Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Internet Security, and Antivirus Plus. The issue allows local privilege escalation to SYSTEM. Affected products/versions are Bitdefender Total Security, Internet Se...

Bitdefender Total Security 代码问题漏洞

Bitdefender Total Security is an active threat protection software for PCs from the Romanian company Bitdefender. The program has antivirus, firewall, anti-spyware, privacy control and parental control features. It also includes features such as System TuneUp. A code issue vulnerability exists in...

rubygem-rack: Denial of service in Multipart MIME parsing

A flaw was found in rubygem-rack. This issue occurs in the Multipart MIME parsing code in Rack, which limits the number of file parts but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than...

Hackers Using Golang Variant of Cobalt Strike to Target Apple macOS Systems

A Golang implementation of Cobalt Strike called Geacon is likely to garner the attention of threat actors looking to target Apple macOS systems. That's according to findings from SentinelOne, which observed an increase in the number of Geacon payloads appearing on VirusTotal in recent months...

Mitigation Confirmed for Mitigation of M-10: Issue mitigated

Mitigated issue M-10: Stuck ether when use function stake with empty derivativesderivativeCount = 0 The issue was that stake will accept payment but not issue safETH when derivativeCount == 0 or when all weightsi == 0. Mitigation review The proposed mitigation simply adds a requirederivativeCount...

Mitigation of M-10: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-10: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings363 Comments Even though the protocol team applied the warden's recommendation in M-10, the feature to enable/disable derivatives added as a mitigati...

PT-2023-22537 · Total.Js · Total.Js

Name of the Vulnerable Software and Affected Versions: TotalJS messenger version b6cf1c9 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field. This enables attackers to...

CVE-2023-25979

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...

CVE-2023-25979

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...

CVE-2023-25979 WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...

CVE-2023-25979

CVE-2023-25979: WordPress Video Gallery (Video Gallery by Total-Soft)

CVE-2023-25979 WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...

rubygem-rack: Denial of service in Multipart MIME parsing

A flaw was found in rubygem-rack. This issue occurs in the Multipart MIME parsing code in Rack, which limits the number of file parts but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than...