7786 matches found
Webshells Observed in Post-Compromised Exchange Servers
CISA has added two new Malware Analysis Reports MARs to Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities. Each new MAR AR21-084A and AR21-084B identifies a webshell observed in post-compromised Microsoft Exchange Servers. After successful exploiting a Microsoft Exchange Server...
Bitweaver 跨站脚本漏洞
Bitweaver is an open source content management system CMS. A security vulnerability exists in Bitweaver version 3.1.0, which can be exploited by remote attackers to inject JavaScript via the user admin edit group.php URI...
GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)
The plugin was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page. PoC...
Using CHIRP to Detect Post-Compromise Threat Activity in On-Premises Environments
CISA Hunt and Incident Response Program CHIRP is a new forensics collection tool that CISA developed to help network defenders find indicators of compromise IOCs associated with the SolarWinds and Active Directory/M365 Compromise. CHIRP is freely available on the CISA GitHub repository. Similar t...
BuddyPress < 7.2.1 - Manage BuddyPress Member Types
The BuddyPress WordPress plugin, versions before 7.2.1, fixed a vulnerability that could allow a user that has just been demoted from an Administrator role to a Subscriber to add/edit/delete BuddyPress Member Types from the Administration screens introduced in the 7.0.0 release...
Moderate: Red Hat Security Advisory: perl security update
An update for perl is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
CVE-2020-35228
A cross-site scripting XSS vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter...
CVE-2020-35227
A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices in the administration web panel allows an attacker to inject IP addresses into the whitelist via the checkedList parameter to the delete command...
Buffer overflow
A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices in the administration web panel allows an attacker to inject IP addresses into the whitelist via the checkedList parameter to the delete command...
Cross site scripting
A cross-site scripting XSS vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter...
CVE-2020-35223
The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed by omitting the CSRF token parameter in HTTP requests...
CVE-2020-35228
CVE-2020-35228 affects NETGEAR JGS516PE/GS116Ev2 switches running v2.6.0.43, where the administration web panel is vulnerable to cross-site scripting via the language parameter. The issue is described as an XSS in the management web interface that could allow attackers to inject arbitrary script/...
CVE-2020-27575
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation...
CVE-2020-27575
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation...
Command injection
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation...
CVE-2020-27575
Maxum Rumpus versions 8.2.13 and 8.2.14 are affected by a command injection vulnerability in the web admin Edit Users form, where an input parameter is vulnerably validated. Root cause: insufficient input validation in the Edit User parameter enables arbitrary command execution. Impact stated acr...
CVE-2020-27575
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation...
[SECURITY] Fedora 32 Update: 389-ds-base-1.4.3.20-2.fc32
389 Directory Server is an LDAPv3 compliant server. The base package inclu des the LDAP server and command line utilities for server administration...