Mail.ru: "😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/

Crossite scripting in community.my.games via post comments due to incomplete fix for 848732 I have been working on this issue for 2 hours and over 300 fails. Finally, I could exploit with a very exotic XSS payload. Payload with an emoji a little trick: %F0%9F%98%82!--😂//=...

CVE-2020-10884

creationtimestamp| type| source ---|---|--- 2020-04-15 16:34:56+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplinkarchera7c7lanrce.rb 2020-04-16 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48331 2025-02-06 03:13:44+00:00|...

CVE-2020-1020

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font – Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could...

Microsoft Windows Multiple Vulnerabilities (KB4550930)

This host is missing a critical security update according to Microsoft KB4550930 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-1027

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka ‘Windows Kernel Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0913, CVE-2020-1000, CVE-2020-1003. Recent assessments: gwillcox-r7 at November 22, 2020 2:27...

Microsoft Patch Tuesday, April 2020 Edition

Microsoft today released updates to fix 113 security vulnerabilities in its various Windows operating systems and related software. Those include at least three flaws that are actively being exploited, as well as two others which were publicly detailed prior to today, potentially giving attackers...

Microsoft Issues Patches for 3 Bugs Exploited as Zero-Day in the Wild

It's April 2020 Patch Tuesday , and during these challenging times of coronavirus pandemic, this month's patch management process would not go easy for many organizations where most of the resources are working remotely. Microsoft today released the latest batch of software security updates for a...

Microsoft Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker...

Debian DSA-4656-1 : thunderbird - security update

Multiple security issues have been found in Thunderbird which could result in denial of service or potentially the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4656. The text...

Cross-Site Request Forgery (CSRF)

squirrelmail is vulnerable to cross-site request forgery. Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted...

Google Chrome Security Update (stable-channel-update-for-desktop_7-2020-04) - Windows

Google Chrome is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-11455

creationtimestamp| type| source ---|---|--- 2020-04-06 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48297 2020-04-14 17:13:45+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/limesurveyziptraversals.rb 2025-02-06...

Slackware 14.2 / current : mozilla-firefox (SSA:2020-094-01)

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2020-094-01. The text itself is copyright C Slackware Linux,...

CVE-2019-17558

creationtimestamp| type| source ---|---|--- 2020-04-02 16:31:27+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solrvelocityrce.rb 2020-04-16 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48338 2021-02-05 21:43:47+00:00|...

CVE-2018-15811

creationtimestamp| type| source ---|---|--- 2020-04-02 15:06:54+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dnncookiedeserializationrce.rb 2020-04-16 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48336 2021-11-08...

Fedora: Security Advisory for chromium (FEDORA-2020-39e0b8bd14)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-8515

creationtimestamp| type| source ---|---|--- 2020-03-27 23:08:11+00:00| exploited| https://t.me/ctinow/21855 2020-04-06 14:30:02+00:00| exploited| https://t.me/SecLabNews/7285 2020-04-10 16:33:40+00:00| exploited| https://t.me/truesecator/456 2020-07-14 09:25:17+00:00| seen|...

CVE-2020-0646

creationtimestamp| type| source ---|---|--- 2020-03-25 16:34:46+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepointworkflowsxoml.rb 2020-03-31 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48275 2021-09-21 06:42:55+00:0...

Oracle Linux 6 : tomcat6 (ELSA-2020-0912)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-0912 advisory. 0:6.0.24-114 - Related: rhbz1806803 Update patch to remove secret attribute renaming 0:6.0.24-113 - Related: rhbz1806803 Add IIS attributes to filter pattern an...

Hackers Actively Exploited 0-Day in CCTV Camera Hardware

Multiple zero-day vulnerabilities were actively being exploited in CCTV security cameras manufactured by Taiwan-based LILIN, researchers found. The company, an IP video solution provider, was being targeted by hackers hijacking the company’s DVR hardware. Once commandeered, hackers then planted...