SQL Injection Vulnerability in Freight Forwarding Quotation System of Shenzhen Yonglian Tong Industry Co.

Shenzhen Yongliantong Industrial Co., Ltd. was established in 2000, which is a modernized and comprehensive import and export foreign trade company approved by the Ministry of Foreign Trade and Economic Cooperation. There is a SQL injection vulnerability in the freight forwarding quotation system...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

flatpak: "file forwarding" feature can be used to gain unprivileged access to files

A sandbox escape flaw was found in the way flatpak handled special tokens in ".desktop" files. This flaw allows an attacker to gain access to files that are not ordinarily allowed by the app's permissions. The highest threat from this vulnerability is to confidentiality and integrity...

RHEL 7 : flatpak (RHSA-2021:1002)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1002 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: file forwarding feature...

Remote Code Execution (RCE)

OpenSSH is vulnerable to remote code execution. The vulnerability exists due to a forwarding of an agent to an attacker-controlled host on an unconstrained agent-socket access on a legacy operating system...

Fedora 33 : flatpak (2021-26ad138ffa)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-26ad138ffa advisory. - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before...

HackerOne: CSRF allows to test email forwarding

Summary: It is possible to send email forwarding emails in the name of victim. The main problem is that you don't verify the X-CSRF-Token in the endpoint /securityemailforwarding/testforwarding.json?id=$id. Steps To Reproduce: - Login as an program user who has access to the Email Forwarding -...

Rafel-Rat - Android Rat Written In Java With WebPanel For Controlling Victims

Rafel is RemoteAccess Tool Used to Control Victims Using WebPanel With More Advance Features. Main Features Admin Permission Add App To White List Looks Like Browser Runs In Background Even App is ClosedMay not work on some Devices Accessibility Feature Support Android v5 - v10 No Port Forwarding...

Easy SMS Hijacking

Vice is reporting on a cell phone vulnerability caused by commercial SMS services. One of the things these services permit is text message forwarding. It turns out that with a little bit of anonymous money -- in this case, $16 off an anonymous prepaid credit card -- and a few lies, you can forwar...

dnsmasq -- cache poisoning vulnerability in certain configurations

Simon Kelley reports: In configurations where the forwarding server address contains an @ character for specifying a sending interface or source address, the random source port behavior was disabled, making cache poisoning attacks possible. This only affects configurations of the form...

SnitchDNS - Database Driven DNS Server With A Web UI

SnitchDNS is a database driven DNS Server with a Web UI, written in Python and Twisted, that makes DNS administration easier with all configuration changed applied instantly without restarting any system services. One of its main features is the logging of all DNS queries allowing the discovery o...

CVE-2020-28899

The Web CGI Script on ZyXEL LTE4506-M606 V1.00ABDO.2C0 devices does not require authentication, which allows remote unauthenticated attackers via crafted JSON action data to /cgi-bin/gui.cgi to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi...

CVE-2020-28899: Missing Authentication for Critical Function

The Web CGI Script on ZyXEL LTE4506-M606 V1.00ABDO.2C0 devices does not require authentication, which allows remote unauthenticated attackers via crafted JSON action data to /cgi-bin/gui.cgi to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi...

[ASA-202103-4] flatpak: sandbox escape

Arch Linux Security Advisory ASA-202103-4 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-21381 Package : flatpak Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1678 Summary ======= The package flatpak before version...

CVE-2021-21381

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...

CVE-2021-21381

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...

Design/Logic Flaw

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...

CVE-2021-21381

Flatpak before 1.10.2 is vulnerable to a sandbox-escape where an attacker can abuse the Exec field in a .desktop file by using tokens like @@ or @@u, causing the user’s files to be exposed to the Flatpak app. The vulnerability, affecting Flatpak versions 0.9.4 through 1.10.1, is fixed in 1.10.2. ...

CVE-2021-21381: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...

CVE-2021-21381

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...