Exploit for Incorrect Resource Transfer Between Spheres in Linuxfoundation Containerd

ABSTRACT SHIMMER CVE-2020-15257 This repo contains proof-of...

Fuel CMS 1.4 Remote Code Execution

!/usr/bin/env ruby Title: Fuel CMS 1.4 - Remote Code Execution Exploit Author: Alexandre ZANNI Date: 2020-11-14 Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 Version: FILE -h | --help Options: Root URL base path including...

PT-2020-15474 · Readyapi +1 · Readyapi Functional Testing Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins SoapUI Pro Functional Testing Plugin versions 1.3 and earlier ReadyAPI Functional Testing Plugin versions 1.3 and earlier Description: The issue concerns the storage of project passwords in an unencrypted manner within job config.xml...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime may affect Tivoli Netcool Performance Manager for Wireless,Oracle January 2020 CPU

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 & 8 used by Tivoli Netcool Performance Manager for Wireless. Tivoli Netcool Performance Manager for Wireless has addressed the applicable CVEs.These issues were disclosed as part of the IBM Java SDK updates in...

JetBrains Kotlin Elevation of Privilege Vulnerability

JetBrains Kotlin is a statically typed programming language from the Czech company JetBrains that runs on the Java Virtual Machine. An elevation of privilege vulnerability exists in JetBrains Kotlin versions 1.4-M1 through 1.4-RC. No details of the vulnerability are provided at this time...

CVE-2020-15824

CVE-2020-15824 affects JetBrains Kotlin from 1.4-M1 to 1.4-RC, with Kotlin 1.3.7x unaffected. The issue is a script-cache privilege escalation caused by cached kotlin-main-kts scripts in the system temporary directory, which is shared by all users by default. The vulnerability is fixed in Kotlin ...

OpenDMARC Resource Management Error Vulnerability

OpenDMARC is an open source implementation of the DMARC Domain-based Message Authentication, Reporting and Conformance specification from The Trusted Domain project. A resource management error vulnerability exists in the 'opendmarcxmlparse' function in OpenDMARC versions 1.3.2 and earlier and...

Design/Logic Flaw

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarcxmlparse that can result in a one-byte heap overflow in opendmarcxml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte...

CVE-2020-12460

OpenDMARC (affected: 1.3.2 and 1.4.x up to 1.4.0-Beta1) is vulnerable to an improper null termination in opendmarc_xml_parse, causing a one-byte heap overflow and remote memory corruption when parsing crafted DMARC aggregate reports. Affected components/file: opendmarc_xml_parse in OpenDMARC. Roo...

Roundcube: Multiple vulnerabilities

Background Free and open source webmail software for the masses, written in PHP. Description Multiple vulnerabilities have been discovered in Roundcube. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround Ther...

Oracle WebCenter Portal Multiple Vulnerabilities (Jul 2020 CPU)

Binary data oraclewebcenterportalcpujul2020.nbin...

CVE-2020-13225

phpIPAM 1.4 contains a stored cross site scripting XSS vulnerability within the Edit User Instructions field of the User Instructions widget...

CVE-2020-13225

phpIPAM 1.4 contains a stored cross site scripting XSS vulnerability within the Edit User Instructions field of the User Instructions widget...

CVE-2020-13225

phpIPAM 1.4 contains a stored cross site scripting XSS vulnerability within the Edit User Instructions field of the User Instructions widget...

phpIPAM cross-site scripting vulnerability (CNVD-2020-34452)

phpIPAM is a set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in phpIPAM version 1.4. The vulnerability stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit the vulnerabili...

SimpliSafe SS3 Authorization Issue Vulnerability (CNVD-2020-31746)

SimpliSafe SS3 is a home security solution from SimpliSafe USA. An authorization issue vulnerability exists in SimpliSafe SS3 using firmware version 1.4, which can be exploited by a local attacker to connect a malicious keypad to a system with an alarm turned on...

CVE-2020-5727

Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to pair a rogue keypad to an armed system...

CVE-2020-5727

CVE-2020-5727 affects SimpliSafe SS3 with firmware version 1.4. The issue is an authentication bypass via an alternate path/channel that lets a local, unauthenticated attacker pair a rogue keypad to an armed system. The publicly available documents confirm the vulnerability details but do not pro...

Improper access control

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...

PlaySMS index.php Unauthenticated Template Injection Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS index.php Unauthenticated Template Injection Code Execution', 'Description' = %q This module exploits a preauth Server-Side Template...