CVE-2020-25474

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting XSS vulnerability via the editorname parameter...

CVE-2020-25473

CVE-2020-25473 affects SimplePHPscripts News Script PHP Pro 2.3. The root cause is that HttpOnly is not set on session cookies, potentially exposing session data to client-side access. The NVD notes a network attack vector with low complexity and no authentication required, leading to partial con...

CVE-2020-25473

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

The Wisconsin GOP Lost $2.3 Million in an Email Scam

Trump's website gets hacked, a ransomware group calls it quits, and more of the week's top security news...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

Unrestricted file upload

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15488

CVE-2020-15488 affects Re:Desk 2.3 and is described as an insecure file upload vulnerability. Public records note this CVE with an NVD entry (NVD: CVE-2020-15488) and related references; associated scores indicate CVSS v2 base 5.0 (Medium) and CVSS v3.1 base 7.5 (High) with network access and low...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

Sql injection

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection in getBaseCriteria() (protected/models/Ticket.php). By altering the folder GET parameter in a crafted URL, arbitrary SQL can be executed, enabling unauthenticated remote command execution via a bizRule eval() in yii/framework/web/auth/CAu...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

HMS Networks Ewon Flexy and Cosy

1. EXECUTIVE SUMMARY CVSS v3 2.3 ATTENTION: Low skill level to exploit Vendor: HMS Networks Equipment: Ewon Flexy and Cosy Vulnerability: Permissive Cross-domain Policy with Untrusted Domains 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to retrieve...

WordPress Theme mTheme-Unus < 2.3 LFI Vulnerability - Version Check

The WordPress theme mTheme-Unus, which comes with the WP Mobile Edition plugin, is prone to a local file inclusion LFI vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2020-25125

GnuPG 2.2.21 and 2.2.22 and Gpg4win 3.1.12 has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG...

RLSA-2020:3032 Moderate: mod_auth_openidc:2.3 security and bug fix update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: Open redirect in logout url when using URLs with leading slashes...

SUSE SLED15 / SLES15 Security Update : libexif (SUSE-SU-2020:1553-2)

This update for libexif to 0.6.22 fixes the following issues : Security issues fixed : CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file bsc1055857. CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exifdatasavedataentry function in...

AWS suffers largest ever DDoS attack of 2.3 TBPS

By Waqas The DDoS attack was mitigated by AWS Shield DDoS protection service. This is a post from HackRead.com Read the original post: AWS suffers largest ever DDoS attack of 2.3 TBPS...

SUSE SLES12 Security Update : libexif (SUSE-SU-2020:1534-1)

This update for libexif fixes the following issues : Security issues fixed : CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file bsc1055857. CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exifdatasavedataentry function in libexif/exif-data.c...