Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2023-1166 |
Description: The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS: LOW (0.0) EPSS Score: 0.06%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-0873 |
Description: The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS: LOW (0.0) EPSS Score: 0.06%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-0588 |
Description: The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
CVSS: LOW (0.0) EPSS Score: 0.08%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-0003 |
Description: A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.
CVSS: MEDIUM (6.5) EPSS Score: 0.12%
November 28th, 2024 (5 months ago)
|
|
Description: Microsoft has re-released the November 2024 security updates for Exchange Server after pulling them earlier this month due to email delivery issues on servers using custom mail flow rules. [...]
November 27th, 2024 (5 months ago)
|
|
|
Description: Hackers have used new GodLoader malware exploiting the capabilities of the widely used Godot game engine to evade detection and infect over 17,000 systems in just three months. [...]
November 27th, 2024 (5 months ago)
|
|
|
Description: Threat actors are using public exploits for a critical authentication bypass flaw in ProjectSend to upload webshells and gain remote access to servers. [...]
November 27th, 2024 (5 months ago)
|
|
|
Description: Zello is warning customers to reset their passwords if their account was created before November 2nd in what appears to be another security breach. [...]
November 27th, 2024 (5 months ago)
|
|
|
Description: Microsoft has denied claims that it uses Microsoft 365 apps (including Word, Excel, and PowerPoint) to collect data to train the company's artificial intelligence (AI) models. [...]
November 27th, 2024 (5 months ago)
|
|
|
Description: Summary
The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier CVE-2024-49203.
Details
Vulnerable code may look as follows:
@GetMapping
public List<Test> getProducts(@RequestParam("orderBy") String orderBy) {
JPAQuery<Test> query = new JPAQuery<Test>(entityManager).from(test);
PathBuilder<Test> pathBuilder = new PathBuilder<>(Test.class, "test");
OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));
JPAQuery<Test> orderedQuery = query.orderBy(order);
return orderedQuery.fetch();
}
Where vulnerability is either caused by pathBuilder.get(orderBy) or the orderBy(order) method itself, based on where the security checks are expected.
PoC
Full POC code is available in repository:
https://github.com/CSIRTTrizna/CVE-2024-49203/
When we take a look at source code shown in Details section the functionality is as follows:
Create JPAQuery object instance:
JPAQuery<Test> query = new JPAQuery<Test>(entityManager).from(test);
Create OrderSpecifier object instance:
PathBuilder<Test> pathBuilder = new PathBuilder<>(Test.class, "test");
OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.ge...
November 27th, 2024 (5 months ago)
|