7785 matches found
The Trump Administration Continues to Erode Election Security
The DHS, the DOJ, and the Office of the Director of National Intelligence have all had recent controversies that bode poorly for electoral integrity...
LimeSurvey 4.3.10 Cross Site Scripting
Exploit Title: LimeSurvey 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting Date: 2020-08-23 Exploit Author: Matthew Aberegg Vendor Homepage: https://www.limesurvey.org Version: LimeSurvey 4.3.10+200812 Tested on: Ubuntu 18.04.4 Patch Link:...
CVE-2020-24054
The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments;...
Command injection
The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments;...
CVE-2020-24054
The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly at a certain time interval as 'root'. One of the limitations of this feature is that it only takes a path to a binary without arguments;...
CVE-2020-24054
The CVE-2020-24054 issue affects Moog EXO Series EXVF5C-2 and EXVP7C2-3 administration consoles. The vulnerability arises from a privileged “statusbroadcast” feature that can spawn a specified binary repeatedly at set intervals as root. Although the feature accepts only a binary path without argu...
CVE-2020-7029
A Cross-Site Request Forgery CSRF vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged...
Cross site request forgery (csrf)
A Cross-Site Request Forgery CSRF vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged...
CVE-2020-7029 Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability
A Cross-Site Request Forgery CSRF vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged...
SBA phishing scams: from malware to advanced social engineering
A number of threat actors continue to take advantage of the ongoing coronavirus pandemic through phishing scams and other campaigns distributing malware. In this blog, we look at 3 different phishing waves targeting applicants for Covid-19 relief loans. The phishing emails impersonate the US Smal...
CLTPHP open source version of the background of the file upload vulnerability
CLTPHP content management system is an efficient site-building PHP content management system , but also an open source CMS system . CLTPHP open source version of the background file upload vulnerability , attackers can use this vulnerability to obtain server administrative privileges...
CVE-2020-15830
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI...
CVE-2020-15830
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI...
CVE-2020-15831
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI...
Cross site scripting
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI...
Cross site scripting
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI...
CVE-2020-15830
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI...
CVE-2020-15830
CVE-2020-15830 affects JetBrains TeamCity prior to 2019.2.3, with a stored XSS vulnerability in the administration UI. The issue is documented in JetBrains’ Q2 2020 security bulletin and mapped to TeamCity as CVE-2020-15830, fixed in 2019.2.3. The connected sources confirm the impact and remediat...
CVE-2020-15831
The provided connected documents confirm a concrete vulnerability: JetBrains TeamCity before 2019.2.3 is affected by a reflected XSS in the administration UI. The NVD entry reports CVSS v2 base 4.3 (Network, no authentication, partial integrity) and CVSS v3.1 base 6.1 (Network, no privileges, UI ...