11783 matches found
WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection
Software CM Pop-Up banners Type Plugin Vulnerable versions = 1.5.10 Fixed in 1.6.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-30750 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a1957d5dbbe6 Credits Dave Jong Patchstack Required privilege...
PT-2023-19753 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS versions up to 4.1.3 Description: A vulnerability was found in the Password Hash Calculation component, specifically affecting the updatePwd function of the UserController.java file. This issue leads to inefficient algorithmic...
Wanted Dead or Alive: Real-Time Protection Against Lateral Movement
Just a few short years ago, lateral movement was a tactic confined to top APT cybercrime organizations and nation-state operators. Today, however, it has become a commoditized tool, well within the skillset of any ransomware threat actor. This makes real-time detection and prevention of lateral...
turnituprecordsandhifi.com Cross Site Scripting vulnerability OBB-3280141
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-19457 · Ks Soft · Advanced Host Monitor
Name of the Vulnerable Software and Affected Versions: ks-soft Advanced Host Monitor versions up to 12.56 Description: A vulnerability was found in the software, classified as problematic, affecting some unknown functionality of the file C:Program Files x86HostMonitorRMA-Winrma active.exe. The...
CVE-2023-2378
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument suffix-rate-up leads to command injection. The attack may be...
CVE-2023-2373
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Management Interface. The manipulation of the argument ecn-up leads to command injection. It is possible to initiate the attack remotely. T...
PT-2023-19198
Name of the Vulnerable Software and Affected Versions Ubiquiti EdgeRouter X versions up to 2.0.9-hotfix.6 Description A critical issue affects some unknown functionality of the Web Management Interface component. The manipulation of the suffix-rate-up argument leads to command injection. The atta...
Ubiquiti EdgeRouter 命令注入漏洞
The Ubiquiti EdgeRouter is a router from Ubiquiti USA. A command injection vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions, which stems from an incorrect operation of the parameter ecn-up that can lead to command injection...
PT-2023-19166
Name of the Vulnerable Software and Affected Versions Ubiquiti EdgeRouter X versions up to 2.0.9-hotfix.6 Description A critical issue was found in the Web Management Interface component. The manipulation of the ecn-up argument leads to command injection, allowing remote attacks. The exploit has...
PT-2023-19174
Name of the Vulnerable Software and Affected Versions Ubiquiti EdgeRouter X versions up to 2.0.9-hotfix.6 Description A critical issue affects the Web Management Interface component, where the manipulation of the src argument leads to command injection. This can be initiated remotely...
Ubiquiti EdgeRouter 命令注入漏洞
The Ubiquiti EdgeRouter is a router from Ubiquiti USA. A command injection vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions, which stems from the fact that incorrect manipulation of the parameter suffix-rate-up can lead to command injection...
XML.php JSONP hijacking
Description The XML.php file has a JSONP hijacking vulnerability. When a user visits a page carefully crafted by the attacker, the JSON data is obtained and sent to the attacker. Proof of Concept We created an HTML file as a proof of concept to showcase the vulnerability. This HTML file will...
CVE-2023-30265
CLTPHP =6.0 is vulnerable to Directory Traversal...
PT-2023-18803 · WordPress · The Profile Builder – User Profile & User Registration Forms
Name of the Vulnerable Software and Affected Versions: The Profile Builder – User Profile & User Registration Forms plugin for WordPress versions up to, and including 3.9.0 Description: The issue arises from the plugin's use of native password reset functionality with insufficient validation on t...
CVE-2023-25485
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bernhard Kux JSON Content Importer plugin = 1.3.15 versions...
Exploit for Injection in Strapi
CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting E...
USN-6040-1 linux-hwe-5.15 vulnerabilities
It was discovered that the Traffic-Control Index TCINDEX implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-1281 It was discovered that the OverlayFS...