‼ CVE-2023-38871 ‼
📖 Read
via "National Vulnerability Database".
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41447 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the index.php component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41450 ‼
📖 Read
via "National Vulnerability Database".
An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5244 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38877 ‼
📖 Read
via "National Vulnerability Database".
A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.📖 Read
via "National Vulnerability Database".
🕴 CAPTCHAs Easy for Humans, Hard for Bots 🕴
📖 Read
via "Dark Reading".
Proton is aiming for the sweet spot between security, privacy, and accessibility with its CAPTCHA.📖 Read
via "Dark Reading".
Dark Reading
CAPTCHAs Easy for Humans, Hard for Bots
Proton is aiming for the sweet spot between security, privacy, and accessibility with its CAPTCHA.
‼ CVE-2023-38872 ‼
📖 Read
via "National Vulnerability Database".
An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42222 ‼
📖 Read
via "National Vulnerability Database".
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38874 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44273 ‼
📖 Read
via "National Vulnerability Database".
Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38873 ‼
📖 Read
via "National Vulnerability Database".
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41446 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script to the title parameter in the index.php component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38870 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-41444 ‼
📖 Read
via "National Vulnerability Database".
An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges via the fun_1400084d0 function in IREC.sys driver.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44275 ‼
📖 Read
via "National Vulnerability Database".
OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5230 ‼
📖 Read
via "National Vulnerability Database".
The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44276 ‼
📖 Read
via "National Vulnerability Database".
OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26145 ‼
📖 Read
via "National Vulnerability Database".
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.**Note:**The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5232 ‼
📖 Read
via "National Vulnerability Database".
The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26149 ‼
📖 Read
via "National Vulnerability Database".
Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:**If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5233 ‼
📖 Read
via "National Vulnerability Database".
The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".