2521 matches found
Security fix for the ALT Linux 9 package dotnet-bootstrap-2.1 version 2.1.25-alt1
2.1.25-alt1 built March 1, 2021 Vitaly Lipatov in task 266708 --- Feb. 17, 2021 Vitaly Lipatov - new version 2.1.25 with rpmgs script - CVE-2021-1721: .NET Core Denial of Service Vulnerability - CVE-2021-24112: .NET 5 and .NET Core Remote Code Execution Vulnerability...
CVE-2019-25020
An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI...
Code injection
An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header which can be manipulated client-side is used for the internal application logs, an attacker can inject wrong IP addresses into these logs...
CVE-2019-25020
CVE-2019-25020 affects Scytl sVote 2.1. The root cause is an unauthenticated sdm-ws-rest API that allows retrieving administrative configuration by sending a POST to /sdm-ws-rest/preconfiguration. The impact is exposure of admin configuration (confidentiality impact noted as HIGH in CVSS 3.1). Ex...
Arbitrary Code Execution
Overview nni is a Neural Network Intelligence package Affected versions of this package are vulnerable to Arbitrary Code Execution. Arbitrary code execution is possible due to a use of a known vulnerable function load within yaml parsing. PoC 1. Create the following PoC file: exploit.py import os...
Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM DataQuant for Workstation (CVE-2015-4000)
Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM DataQuant for Workstation. Vulnerability Details CVEID: CVE-2015-4000 The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey...
Microsoft .NET Core Security Vulnerability
Microsoft .NET Core is a free open source development platform from Microsoft USA. The platform is characterized by multi-language support and cross-platform. A security vulnerability exists in Microsoft .NET Core and Microsoft Visual Studio. The following products and versions are...
PT-2021-2080 · Microsoft +3 · System.Text.Encodings.Web +4
Name of the Vulnerable Software and Affected Versions: .NET Core versions 2.1, 3.1, and 5.0 System.Text.Encodings.Web versions 4.0.0 through 4.5.0 System.Text.Encodings.Web versions 4.6.0 through 4.7.1 System.Text.Encodings.Web version 5.0.0 Description: The vulnerability is related to insufficie...
PT-2021-10094 · Apache · Apache Cassandra
Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 2.1.0 through 2.1.22 Apache Cassandra versions 2.2.0 through 2.2.19 Apache Cassandra versions 3.0.0 through 3.0.23 Apache Cassandra versions 3.11.0 through 3.11.9 Description: The issue allows both encrypted and...
CVE-2020-29662
In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...
CVE-2020-29662
In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...
Debian DLA-2534-1 : sudo security update
The Qualys Research Labs discovered a heap-based buffer overflow vulnerability in sudo, a program designed to provide limited super user privileges to specific users. Any local user sudoers and non-sudoers can exploit this flaw for root privilege escalation. For Debian 9 stretch, this problem has...
Input validation
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges...
Authentication flaw
The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...
Security Bulletin: A security vulnerability in Node.js serialize-javascript affects IBM Cloud Pak for Multicloud Management Managed Service.
Summary A security vulnerability in Node.js serialize-javascript affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details Third Party Entry: 186585 DESCRIPTION: Node.js serialize-javascript module code execution CVSS Base score: 9.8 CVSS Temporal Score: See:...
Magicpin Cross-Site Scripting Vulnerability
Magicpin is an Indian hyperlocal lifestyle services exploration platform. Based on geographic location, it helps merchants and users to interact and communicate, mainly providing users with information on promotional and discounted activities, content changes, merchant dynamics, as well as social...
Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure Exploit
Exploit Title: Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure Exploit Author: Nitesh Surana Vendor Homepage: https://www.gxgroup.eu/ont-products/ Version: P4410-V2-1.34H Tested on: Windows/Kali CVE : CVE-2020-25988 import upnpy upnp = upnpy.UPnP Discover UPnP devices on the network...
PT-2020-15833 · Phpgurukul · Phpgurukul User Registration & Login/User Management System With Admin Panel
Name of the Vulnerable Software and Affected Versions: PHPGurukul User Registration & Login and User Management System With admin panel version 2.1 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the Registration page of the admin panel. This type of vulnerability...