Tag
#php
Xhibiter NFT Marketplace version 1.10.2 suffers from a cross site scripting vulnerability.
eStore CMS version 2.0 suffers from a remote SQL injection vulnerability.
Clenix version 1.0 suffers from an insecure direct object reference vulnerability.
Candy Redis version 2.1.2 appears to suffer from an administrative page disclosure issue.
Agop CMS version 1.0 suffers from an insecure direct object reference vulnerability.
XenForo versions 2.2.15 and below suffer from a remote code execution vulnerability in the Template system.
XenForo versions 2.2.15 and below suffer from a cross site request forgery vulnerability in Widget::actionSave.
### Summary In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.php#L41-L60 ### PoC One can use [`phpggc`](https://github.com/ambionics/phpggc/) and the chain `Guzzle/FW1` to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie `bb_t` will be deserialized when browsing to `viewforum.php`.
A malicious Telegram bot is the key to a veritable flourishing garden of nefarious cybercriminal activity, which was discovered via a series of Python packages.
### Summary The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. ### Details When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the `allowedCredentials` property in the assertion options response. This allows enumeration of valid or invalid usernames. #### Proposal how to resolve it: ``` return $this->publicKeyCredentialRequestOptionsFactory->create( $this->profile, count($allowedCredentials) <= 0 ? self::getRandomCredentials(): $allowedCredentials, $optionsRequest->userVerification, $extensions ); private static function getRandomCredentials(): array { $credentialSources = []; for ($i = 0; $i <= rand(0,1); $i++) { $credentialSources[] = new PublicKeyCredentialSource( random_bytes(32), "public-key", [], ...