Automattic: [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id}

Summary: Hello, I have found an XSS Reflected POST-Based on https://www.intensedebate.com/update/tumblr2/$id. The parameter $POST'txtCode' is reflected and is not sanitized. To trigger the XSS an attacker need to create a site and invite the victim in their own site and give then full permissions...

CVE-2020-14208

SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting XSS in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML...

CVE-2020-28133

An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in salesinventory/login.php...

CVE-2020-8272

Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8...

CVE-2020-8272

Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8...

CVE-2020-15481

CVE-2020-15481 affects PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. The kernel drivers DirectIo32.sys and DirectIo64.sys expose IOCTL functionality that allows low-privilege users to map arbitrary physical memory into the calling process’...

Citrix SD-WAN Center 10.2.x < 10.2.8 / 11.1.x < 11.1.2b / 11.2.x < 11.2.2 Multiple Vulnerabilities (CTX285061)

The remote Citrix SD-WAN Center is version 10.2.x prior to 10.2.8, 11.1.x prior to 11.1.2b, 11.2.x prior to 11.2.2. It is, therefore, affected by multiple vulnerabilities: - An unauthenticated remote code execution with root privileges. CVE-2020-8271 - A authentication bypass resulting in exposur...

Microsoft Dynamics 365 (on-premises) Update 2.24

None None...

Service Update 0.22 for Microsoft Dynamics 365 9.0

None None...

[SECURITY] Fedora 32 Update: libtpms-0.7.4-0.20201031git2452a24dab.fc32

A library providing TPM functionality for VMs. Targeted for integration into Qemu...

[SECURITY] Fedora 31 Update: libtpms-0.7.4-0.20201031git2452a24dab.fc31

A library providing TPM functionality for VMs. Targeted for integration into Qemu...

CDFMonitor

NOTE : CDFMonitor is now deprecated, to capture trace as service use - https://support.citrix.com/article/CTX677255/citrix-cdfcontrol-as-service Please note: You can download the required file from the Citrix downloads website by visiting the following...

PT-2023-3316 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to insufficient limitations on the start page preference in Moodle, allowing a remote attacker to set this preference for another user. This enables the attacker to gain...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

Mail.ru: Disk-o Cloud application (Windows) does not validate server certificate on a TLS connection

A debugging/staging functionality disabling TLS certificate check was accidentally enabled in production code for Disk-O 20.10.0133, fixed in version 20.11.0006. 21.04 version adds integrity check for update process...

PDW File Browser 1.3 - Remote Code Execution

Exploit Title: PDW File Browser 1.3 - Remote Code Execution Date: 24-10-2020 Exploit Author: David Bimmel Researchers: David Bimmel, Joost Vondeling, Ramòn Janssen Vendor Homepage: n/a Software Link: https://github.com/GuidoNeele/PDW-File-Browser Version: … ? Once you have uploaded your webshell...

hyperv-daemons bug fix and enhancement update

The hyperv-daemons packages provide a suite of daemons that are needed when a AlmaLinux guest is running on Microsoft Hyper-V. The following daemons are included: - hypervkvpd, the guest Hyper-V Key-Value Pair KVP daemon - hypervvssd, the implementation of Hyper-V VSS functionality - hypervfcopyd...

SQL Injection

pimcore is vulnerable to SQL injection. An attacker is able to inject and execute arbitrary SQL statements on the database via the data classification functionality in ClassificationstoreController, due to inadequate validation of relationIds parameter...

OSV-2020-2106 UNKNOWN READ in grk::SparseBuffer<6u, 6u>::read_or_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26702 Crash type: UNKNOWN READ Crash state: grk::SparseBuffer::readorwrite grk::SparseBuffer::read bool grk::decompresspartialtile...