EulerOS 2.0 SP9 : nss (EulerOS-SA-2022-1310)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

EulerOS 2.0 SP5 : nss (EulerOS-SA-2022-1278)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

PT-2022-8971

Name of the Vulnerable Software and Affected Versions 15Zine WordPress theme versions prior to 3.3.0 Description The issue concerns a Reflected Cross-Site Scripting problem. It arises because the cbi parameter is not properly sanitised and escaped before being output in the response via the cb s ...

CVE-2021-25100

The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-25100: Improper Neutralization of Input During Web Page Generation

The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting...

PT-2022-9655

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 2.17.3 Description The issue concerns a Reflected Cross-Site Scripting problem. It occurs because the s parameter is not properly escaped before being outputted back in an attribute in the Donation Forms dashboard...

SUSE: Security Advisory (SUSE-SU-2022:0467-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-10073

Name of the Vulnerable Software and Affected Versions DuxCMS version 3.1.3 Description A SQL injection issue was found in DuxCMS via the component "s/tools/SendTpl/index?keyword=". This allows for potential SQL injection attacks. Recommendations For DuxCMS version 3.1.3, consider restricting acce...

CVE-2021-3242: Improper Neutralization of Special Elements used in an SQL Command

DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=...

S-Cart path traversal vulnerability

S-cart, a Php-based e-commerce management platform from the S-cart community, suffers from a path traversal vulnerability that stems from the failure of a web-based system or product to properly filter special elements in the path of a resource or file. An attacker could exploit the vulnerability...

CVE-2022-23317: Improper Authentication

CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

Sql injection

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

CVE-2022-23336

S-CMS v5.0 has a SQL injection in member_pay.php via the O_id parameter. Root cause: improper handling of O_id leads to injectable SQL statements. Impact ranges from partial confidentiality, integrity, and availability impacts per CVSS data (base scores 7.5/9.8). No exploitation details or fixes ...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn, Estonia on June 3, 2022. I’m speaking at the RSA Conference 2022 in San Francisco...

CVE-2022-0193

The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

Directory Traversal

S-Cart is vulnerable to directory traversal. The vulnerability exists due to a lack of sanitization of the input via the download function allowing an attacker to download arbitrary file via the download request...