:: Deepquest ::

HRSALE The Ultimate HRM version 1.0.2 suffers from a local file inclusion vulnerability.

HRSALE The Ultimate HRM version 1.0.2 suffers from a cross site scripting vulnerability.

Google Chrome V8 Await methods call ResolveNativePromise which calls InternalResolvePromise which can invoke a user JavaScript code through a “then” getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state.

GitList version 0.6 unauthenticated remote code execution exploit.

This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable.

Apple Security Advisory 2018-04-24-1 – iOS 11.3.1 is now available and addresses code execution vulnerabilities.

Apple Security Advisory 2018-04-24-2 – Security Update 2018-001 is now available and addresses privilege escalation and UI spoofing issues.

Apple Security Advisory 2018-04-24-3 – Safari 11.1 is now available and addresses code execution vulnerabilities.

http://maesalocal.go.th/def.html notified by Mister