Code injection

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278 Risk of code injection in RSSHub

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278

RSSHub is affected by a code-injection vulnerability in which certain routes use eval or the Function constructor, allowing unsafe code to be injected by a target site. The root cause is unsafe dynamic code evaluation in specific routes. The fix (version 7f1c430) temporarily removes the problemat...

CVE-2021-1782

creationtimestamp| type| source ---|---|--- 2021-01-26 19:50:53+00:00| exploited| https://t.me/alexmakus/3855 2021-01-27 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=543 2021-02-15 06:56:29+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2694...

PT-2021-11109

Name of the Vulnerable Software and Affected Versions: Reolink P2P products affected versions not specified Description: The issue concerns insufficient protection of data transferred between local devices and Reolink servers, potentially allowing attackers to access sensitive information like...

python-urllib3: CRLF injection via HTTP request method

A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrit...

Umbrella_android - Digital And Physical Security Advice App

Umbrella is an Android mobile app developed by Security First that provides human rights defenders with the information on what to do in any given security situation and the tools to do it. It allows the user to choose what they want to do, such as: protect data; securely make a call/email;...

Moderate: Red Hat Security Advisory: Red Hat Quay v3.3.3 bug fix and security update

Red Hat Quay v3.3.3 is now available with bug fixes and security updates. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Hack-Tools v0.3.0 - The All-In-One Red Team Extension For Web Pentester

The all-in-oneRed Team browser extension for Web Pentesters HackTools, is a web extension facilitating your web application penetration tests , it includes cheat sheets as well as all the tools used during a test such as XSS payloads, Reverse shells and much more. With the extension you no longer...

CVE-2019-25012

The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered by Drupal's security advisory policy...

CVE-2020-5801

creationtimestamp| type| source ---|---|--- 2020-12-29 18:29:35+00:00| seen| https://t.me/cibsecurity/21384...

Google Http package For Dart 注入漏洞

Google Http package For Dart is a U.S. Google Inc. for the Dart programming language Http support code base . A cross-site request forgery vulnerability exists in Google Http package For Dart version 0.12.2 and earlier versions, which allows an attacker to implement a CRLF injection into an HTTP...

CVE-2020-4006

creationtimestamp| type| source ---|---|--- 2020-11-24 00:46:21+00:00| seen| https://t.me/cibsecurity/16761 2020-11-24 06:05:07+00:00| seen| https://t.me/cKure/2959 2020-11-24 08:29:30+00:00| seen| https://t.me/thehackernews/906 2020-11-26 00:48:50+00:00| published-proof-of-concept|...

CVE-2020-13671

creationtimestamp| type| source ---|---|--- 2020-11-20 18:42:49+00:00| seen| https://t.me/cibsecurity/16662 2020-11-20 18:45:49+00:00| seen| https://t.me/cKure/2918 2020-12-09 07:25:06+00:00| seen| https://t.me/cibsecurity/17408 2023-06-14 21:10:04+00:00| seen|...

TYPO3 代码问题漏洞

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 suffers from a security vulnerability that stems from insufficient validation of user-supplied XML input in RSS widgets, which can be exploited by a remote user to pass specially...

ILIAS Remote Code Execution Vulnerability

ILIAS is a powerful open source learning management system for developing and implementing web-based e-learning. A remote code execution vulnerability exists in ILIAS 6.4. The vulnerability stems from a parameter validation error on Magpie RSS data. An attacker can exploit this vulnerability to...

CVE-2020-25268

Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data...

Remote code execution

Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data...

CVE-2020-25268

ILIAS 6.4 is vulnerable to Remote Code Execution via the external news feed due to incorrect parameter sanitization of Magpie RSS data. The issue affects the Magpie RSS data parsing path, enabling an attacker to execute code remotely. CVSS details indicate a high impact (C, I, A high) with networ...

CVE-2020-13927

creationtimestamp| type| source ---|---|--- 2020-11-10 18:27:36+00:00| seen| https://t.me/cibsecurity/16094 2021-06-03 00:39:25+00:00| seen| https://t.me/pwnwikizhchannel/579 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-09-18 22:16:38+00:00| seen|...