ERPNext Reflective Cross-Site Scripting Vulnerability (CNVD-2020-18553)

ERPNext is a free, open source, integrated enterprise resource planning software. A reflected cross-site scripting vulnerability exists in ERPNext 11.1.47. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the PATHINFO of the addresses/ URI...

CVE-2019-20515

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...

CVE-2019-20515

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...

Cross site scripting

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...

CVE-2019-20515

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...

usrsctp: Out of bounds reads in sctp_load_addresses_from_init()

The Mozilla Foundation Security Advisory describes this flaw as: The inputs to sctploadaddressesfrominit are verified by sctparethereunrecognizedparameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a...

TrickBot Now Exploits Infected PCs to Launch RDP Brute Force Attacks

A new module for TrickBot banking Trojan has recently been discovered in the wild that lets attackers leverage compromised systems to launch brute-force attacks against selected Windows systems running a Remote Desktop Protocol RDP connection exposed to the Internet. The module, dubbed...

CVE-2020-10240

An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses...

CVE-2020-10240

An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses...

CVE-2020-10240

CVE-2020-10240 affects Joomla! up to version 3.9.15, where missing length checks in the users table can allow creation of users with duplicate usernames or email addresses. The issue is documented across multiple sources (NVD, OSV, and OSSV listings) as a data-validation flaw in the user table, w...

usrsctp: Out of bounds reads in sctp_load_addresses_from_init()

The Mozilla Foundation Security Advisory describes this flaw as: The inputs to sctploadaddressesfrominit are verified by sctparethereunrecognizedparameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a...

BSA-2020-937

Security Advisory ID : BSA-2020-937 Component : lldpd Revision : 1.0: Final Buffer overflow in the lldpdecode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via vectors involving large...

Windows GDI Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface GDI handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not allow arbitrary code execution; however, it could...

NTLMRecon - A Tool To Enumerate Information From NTLM Authentication Enabled Web Endpoints

Note that the tool is still under development. Things may break anytime - hence, beta! A fast and flexible NTLM reconnaissance tool without external dependencies. Useful to find out information about NTLM endpoints when working with a large set of potential IP addresses and domains. NTLMRecon is...

PrestaShop Information Disclosure Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. An information disclosure vulnerability exists in PrestaShop versions prior to 1.7.6....

CVE-2020-10212

CVE-2020-10212 concerns Responsive FileManager. The vulnerability is an SSRF in upload.php via the url parameter, affecting 9.13.4 and 9.14.0, with the issue rooted in how file-extension blocking is handled and DNS hostnames resolving to internal IPs; this is noted as a consequence of an incomple...

DEBIAN-CVE-2019-20503

usrsctp before 2019-12-20 has out-of-bounds reads in sctploadaddressesfrominit...

AZL-35345 CVE-2019-20503 affecting package usrsctp for versions less than 0.9.5.0-1

usrsctp before 2019-12-20 has out-of-bounds reads in sctploadaddressesfrominit...

Virgin Media Data Leak Exposes Details of 900,000 Customers

On the same day yesterday, when the US-based telecom giant T-Mobile admitted a data breach, the UK-based telecommunication provider Virgin Media announced that it has also suffered a data leak incident exposing the personal information of roughly 900,000 customers. What happened? Unlike the...

GHSA-738M-F33V-QC2R SMTP Injection in PHPMailer

Impact Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts. Patches Fixed in 5.2.14 in this commit. Workarounds Manually strip line breaks from email addresses before passing...