Do you know about an emerging new infostealer malware named DockLogs

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary DuckLogs is a new info-stealing malware variant, which is sold as Malware-as-a-Service MaaS product. It captures and exfiltrates data from infected PCs such as credentials, cookies, crypto wallets, brows...

Cross site scripting

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in the vulnerability...

CVE-2022-45050 Reflected XSS in Axiell Iguana CMS

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in the vulnerability...

Lansweeper lansweeper KnowledgebasePageActions.aspx ImportArticles directory traversal vulnerability

Talos Vulnerability Report TALOS-2022-1530 Lansweeper lansweeper KnowledgebasePageActions.aspx ImportArticles directory traversal vulnerability December 1, 2022 CVE Number CVE-2022-29511 SUMMARY A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles...

PT-2022-27393 · Axiell · Axiell Iguana Cms

Name of the Vulnerable Software and Affected Versions: Axiell Iguana CMS affected versions not specified Description: A reflected XSS issue has been found, allowing an attacker to execute code in a victim's browser. The title parameter on the "twitter.php" endpoint does not properly neutralize us...

CVE-2021-31740

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

CVE-2021-31740

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

WordPress Showing URL in QR Code plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Easy WP SMTP < 1.5.2 - Admin+ Arbitrary File Access

The plugin does not validate some user input used to generate paths, which could allow high privilege users such as admin to access arbitrary files even when they should not be able to, for example in multisite via a traversal attack...

CVE-2022-3384 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populatedropdownoptions function that accepts user supplied input and passes it through calluserfunc. This is restricted to non-parameter PHP functions like phpinfo; sin...

CVE-2022-3384 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populatedropdownoptions function that accepts user supplied input and passes it through calluserfunc. This is restricted to non-parameter PHP functions like phpinfo; sin...

CVE-2022-41676

Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS Reflected Cross-Site Scripting attack to the mail recipient...

Cross site scripting

Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS Reflected Cross-Site Scripting attack to the mail recipient...

CVE-2022-41676 TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Cross-Site Scripting

Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS Reflected Cross-Site Scripting attack to the mail recipient...

moment: inefficient parsing algorithm resulting in DoS

A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service ReDoS attacks...

CVE-2022-3490

The Checkout Field Editor Checkout Manager for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

Sinatra 安全漏洞

Sinatra is a DSL for easily creating web applications in Ruby. A security vulnerability exists in Sinatra version 2.0 up to and including version 2.2.3, and version 3.0 up to and including version 3.0.4, which stems from an application being vulnerable to a Reflected File Download RFD attack when...

Oracle E-Business Cross-Site Scripting (CVE-2021-2198)

A stored cross-site scripting vulnerability exists in the Knowledge Management component of Oracle E-Business Suite. The vulnerability is due to the use of untrusted user input...

PT-2022-27677

Name of the Vulnerable Software and Affected Versions PaddlePaddle versions prior to 2.4 Description The issue arises from the paddle.audio.functional.get window function calling eval on a user-supplied winstr, leading to potential code injection and arbitrary code execution. Recommendations For...

Remote Code Execution

yiisoft/yii is vulnerable to remote code execution. The vulnerability exists in the wakeup function of CDbCriteria.php, due to improper deserialization of untrusted user input, which allows the attacker to control the state or the flow of execution...