5949 matches found
Python-based Spy RAT Emerges to Target FinTech
The Evilnum group, which specializes in targeting financial technology companies, has debuted a new tool: A Python-based remote access trojan RAT, dubbed PyVil. The malware’s emergence dovetails with a change in the chain of infection and an expansion of infrastructure for the APT. According to...
openSIS SQL Injection Vulnerability (CNVD-2020-50528)
openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the bday parameter in CheckDuplicateStudent.php in openSIS 7.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attack...
Design/Logic Flaw
A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-downloadfiles of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects:...
MGASA-2020-0331 Updated tomcat packages fix security vulnerability
A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive CVE-2020-11996. An h2c direct connection did not release the HTTP/1.1 processo...
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution (cisco-sa-rv-rce-AQKREqp)
According to its self-reported version, Cisco Small Business RV Series Router Firmware is affected by default remote command execution vulnerability. The vulnerability is due to improper validation of user-supplied input in the web- based management interface. A remote, unauthenticated attacker...
Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests
A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...
Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software
CVE-2020-3452 Cisco Adaptive Security Appliance ASA & Cisco...
Laravel Telescope Information Disclosure Vulnerability
Laravel Telescope is erroneously publicly accessible. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:laravel:telescope"; if...
The vulnerability in the web interface (wwsympa.fcgi) of the Sympa mailing list manager allows a perpetrator to escalate their privileges.
The vulnerability in the web interface wwsympa.fcgi of the Sympa mailing list manager is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to enhance their privileges through specially...
All-Dynamics Digital Signage System 2.0.2 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: All-Dynamics Digital Signage System 2.0.2 - Cross-Site Request Forgery Add Admin Discovery by: LiquidWorm Discovery Date: 2020-08-05 Vendor Homepage: https://www.all-dynamics.de !-- All-Dynamics Software enlogic:show Digital...
Information Disclosure
squid is vulnerable to information disclosure. Due to incorrect input validation, the application interprets malicious HTTP requests in unexpected ways to access server resources prohibited by earlier security filters...
CVE-2020-3374
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...
CVE-2020-3374
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...
CVE-2020-3374 Cisco SD-WAN vManage Software Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...
CVE-2020-3374 Cisco SD-WAN vManage Software Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...
All-Dynamics Software enlogic:show Digital Signage System 2.0.2 CSRF Add Admin
Summary Bring communication with your customers, guests or employees to a new level. You can design content individually and uncomplicated centrally and simply present it in different locations. Whether on large displays, steles, digital signs or on a projector, with enlogic:show your content wil...
CVE-2020-7699
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...
USN-4443-1: Firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass iframe sandbox restrictions, confuse the user, or execute arbitrary...
Cisco SD-WAN vManage Software Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The...