[SECURITY] [DSA 5410-1] sofia-sip

------------------------------------------------------------------------- Debian Security Advisory DSA-5410-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 24, 2023 https://www.debian.org/security/faq -...

Hubstaff 1.6.14-61e5e22e DLL Hijacking

Exploit Title: Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking Date: 14/05/2023 Exploit Author: Ahsan Azad Vendor Homepage: https://hubstaff.com/ Software Link: https://app.hubstaff.com/download Version: 1.6.13, 1.6.14 Tested On: 64-bit operating system, x64-based processor...

WordPress UTM Tracker Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software UTM Tracker Type Plugin Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23822 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 19de6728460e Credits Rio Darmawan Required privile...

Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking

Exploit Title: Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking Date: 14/05/2023 Exploit Author: Ahsan Azad Vendor Homepage: https://hubstaff.com/ Software Link: https://app.hubstaff.com/download Version: 1.6.13, 1.6.14 Tested On: 64-bit operating system, x64-based processor...

[SECURITY] [DLA 3431-1] sqlite security update

Debian LTS Advisory DLA-3431-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost May 22, 2023 https://wiki.debian.org/LTS Package : sqlite Version : 2.8.17-15+deb10u1 CVE ID : CVE-2016-6153 CVE-2018-8740 Debian Bug : Two vulnerabilities have been fixed in sqlite V2 whi...

[SECURITY] [DLA 3429-1] imagemagick security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3429-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaries May 21, 2023 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3427-1] texlive-bin security update

Debian LTS Advisory DLA-3427-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 20, 2023 https://wiki.debian.org/LTS Package : texlive-bin Version : 2018.20181218.49446-1+deb10u1 CVE ID : CVE-2023-32700 Max Chernoff discovered that improperly secured shell-esca...

Vulnerabilities fixed in Tracker Software PDF-Xchange

Tracker Software has fixed vulnerabilities in PDF-Xchange. A malicious party could exploit the vulnerabilities to cause a denial-of-service and potentially execute code with privileges of the victim. This requires the malicious party to trick the victim into opening a malicious file to open...

[SECURITY] [DSA 5405-1] libapache2-mod-auth-openidc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5405-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 18, 2023 https://www.debian.org/security/faq -...

CVE-2023-2772

A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/managebudget.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It i...

CVE-2023-2772

A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/managebudget.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It i...

Sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/managebudget.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It i...

CVE-2023-2772 SourceCodester Budget and Expense Tracker System GET Parameter manage_budget.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/managebudget.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It i...

CVE-2023-2772 SourceCodester Budget and Expense Tracker System GET Parameter manage_budget.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/managebudget.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It i...

CVE-2023-2772

CVE-2023-2772 concerns SourceCodester Budget and Expense Tracker System 1.0. The vulnerability is an SQL injection in the GET parameter handler, specifically an unknown function of /admin/budget/manage_budget.php where the id argument is manipulated to inject SQL. This vulnerability can be exploi...

File Tracker Manager System Cross-Site Scripting Vulnerability

File Tracker Manager System is a file tracker manager system. File Tracker Manager System v1.0 version of a cross-site scripting vulnerability, the vulnerability stems from the /filemanager/admin/saveuser.php parameter firstname of the user-supplied data lack of effective filtering and escaping, ...

PT-2023-21308 · Unknown · Sourcecodester Budget/Expense Tracker System

Name of the Vulnerable Software and Affected Versions: SourceCodester Budget and Expense Tracker System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /admin/budget/manage budget.php of the component GET Parameter Handler. The...

Fedora 38 : golang (2023-7eb5fe654d)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-7eb5fe654d advisory. go1.20.4 released 2023-05-02 includes three security fixes to the html/template package, as well as bug fixes to the compiler, the runtime, and the...

aries-askar (>=0.1.2 <=0.2.7), arkworks-r1cs-gadgets (>=0.5.0 <=1.2.0) +106 more potentially affected by unknown CVE via xsalsa20poly1305 (>=0.4.2 <=0.9.1)

xsalsa20poly1305 CARGO version =0.4.2, =0.1.2, =0.5.0, =0.5.0, =0.2.0, =0.1.0, =0.1.0, =0.1.1 - bramble-handshake =0.1.0 - bramble-qr =0.1.0 - bramble-rendezvous =0.1.0 - bramble-sync =0.1.0 - bramble-transport =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0037...

CVE-2023-32308 SQL Injection Vulnerability in anuko timetracker

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for error...