PT-2020-13410 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.10 through 13.0.1 Description: A Reflected Cross-Site Scripting issue allowed the execution of arbitrary Javascript code on the Static Site Editor. Recommendations: For GitLab CE/EE versions 12.10 through 13.0.1, upda...

How to Verify Adaptive Acceleration Features are Working on Browser

As we know, Adaptive Acceleration's umbrella consists of the below features: 1. Automatic Push/Preconnect 2. Resource Optimizer 3. Automatic Font Preload 4. Script Management To read more about these features, please refer to Akamai Community. Now let's see how we can validate if these features a...

h1-ctf: [H1-2006 2020] [CTF Writeup] A story about Bounty Payments, Collaboration & Community

H1-2006 CTF Writeup This is a story about both solving a CTF and, most importantly, on how to make friends during the journey and learn a lot a valuable things for the future. On a Friday evening I saw this tweet from HackerOne: F853545 Honestly, last CTF was really hard so I didn't really though...

Message from Eva Chen – as a human being, not a CEO: We need to speak out and act against racism

I would like to express my outrage over the brutal killings of George Floyd, Breonna Taylor, and Ahmaud Arbery – not as the CEO of an international company, but as a human being and a citizen of the world. It makes me very sad, but also intensely frustrated and angry to realize how little is bein...

The vulnerability of the Self-Service component of the Oracle PeopleSoft Enterprise CS Campus Community application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Self-Service component of the Oracle PeopleSoft Enterprise CS Campus Community application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

comunidad.madrid Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1184626 Security Researcher foreverunc Helped patch 50 vulnerabilities Received 3 Coordinated Disclosure badges Received 2 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting comunidad.madrid website a...

CVE-2020-3235

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient input...

QuickBox Remote Code Execution Vulnerability

QuickBox is a media server application and service management system from the QuickBox team. The system supports the installation and management of applications using dashboards that enable users to interact with media servers. A remote code execution vulnerability exists in QuickBox Community...

QuickBox OS Command Injection Vulnerability

QuickBox is a media server application and service management system from the QuickBox team. The system supports the installation and management of applications using dashboards that enable users to interact with media servers. An operating system command injection vulnerability exists in QuickBo...

CVE-2020-13695

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

CVE-2020-13695

CVE-2020-13695 affects QuickBox Community Edition up to 2.5.5 and QuickBox Pro up to 2.1.8. The local www-data user has passwordless sudo privileges to run grep as root, enabling an attacker to read sensitive files such as /root/*.db and /etc/shadow. This results in potential exposure of confiden...

CVE-2020-13694

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option...

CVE-2020-13448

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter...

CVE-2020-13694

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option...

CVE-2020-13448

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter...

Command injection

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter...

CVE-2020-13694

Technical details for CVE-2020-13694 are not provided in the connected documents; the available sources lack affected product/version/impact specifics beyond the initial description. Monitor for updates.

CVE-2020-13448

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter...

CVE-2020-13448

CVE-2020-13448 affects QuickBox Community Edition up to 2.5.5 and Pro Edition up to 2.1.8. An authenticated attacker can exploit a command-injection vulnerability in the servicestart parameter to achieve remote code execution (as www-data). Public CVSS: high (3.1/8.8) with network access and low ...

MuleSoft Mule Resource Management Error Vulnerability

MuleSoft Mule is a lightweight integration platform from MuleSoft, USA. The platform supports management of message routing between nodes, data mapping, and more. A security vulnerability exists in MuleSoft Mule Community and Enterprise Editions versions 3.8.x, 3.9.x, and 4.x released before Apri...