File Upload Vulnerability in Station Helper Master CMS (CNVD-2021-49093)

Station Helpers CMS is a CMS open source system dedicated to creating a full-featured ... Station Helpers CMS has a file upload vulnerability that can be exploited by attackers to gain control of the server...

OESA-2021-1236 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: A possible information disclosure/unintended method execution vulnerability...

writeup

This is a Python script for exploiting a vulnerability in the "Aegis" binary. The script is designed to be used with the "pwn" library, which is a Python library for exploitation. The script starts by setting a debug flag to 1, which means that the script will run in debug mode. If the debug flag...

Binary Vulnerability in IT Helpers of Suning.com Group Co.

IT Helper is a comprehensive computer management software. Suning.com Group Inc IT Helper has a binary vulnerability that can be exploited by attackers to cause a blue screen on a computer...

CVE-2021-0480

In createPendingIntent of SnoozeHelper.java, there is a possible broadcast intent containing a sensitive identifier. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

JerryScript 资源管理错误漏洞

JerryScript is a lightweight JavaScript engine designed to run on very constrained devices such as microcontrollers. A post-release reuse vulnerability exists in ecmarefecmastring in ecma-helpers-string.c:772 in JerryScript version 2.2.0. No detailed vulnerability details are provided at this tim...

The vulnerability of the ajaxhelper.php component of the Nagios Fusion software, which is used for visualizing the operational status of IT infrastructure, allows a hacker to gain access to user passwords.

The vulnerability of the ajaxhelper.php component of the Nagios Fusion software, which is used for visualizing the operational status of IT infrastructure, relates to the insecure storage of confidential information. Exploiting this vulnerability could allow an attacker, operating remotely, to ga...

CVE-2021-22885

A possible information disclosure / unintended method execution vulnerability in Action Pack = 2.0.0 when using the redirectto or polymorphicurlhelper with untrusted user input...

PT-2021-8259 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The vulnerability is related to the nft ct expect obj eval function in the Linux kernel's netfilter component. It is caused by the function calling nf ct ext add for a confirmed...

Apache Fineract 安全漏洞

Apache Fineract is a set of open source digital financial services platform from the U.S. Apache Apache Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. A security vulnerability exists in Apach...

Data Wiper Malware Disguised As Ransomware Targets Israeli Entities

Researchers on Tuesday disclosed a new espionage campaign that resorts to destructive data-wiping attacks targeting Israeli entities at least since December 2020 that camouflage the malicious activity as ransomware extortions. Cybersecurity firm SentinelOne attributed the attacks to a nation-stat...

PT-2021-16925 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.26 Description: An issue was discovered where HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors. Recommendations: For Joomla! versions 3.0.0 through 3.9.2...

‘Agrius’ APT Launches Wiper Attacks Against Israelis

A new attack group called Agrius is launching damaging wiper attacks against Israeli targets, which researchers said are hiding behind ransomware to make their state-sponsored activities appear financially motivated. Sentinel Labs analysts said they have been tracking Agrius’ operations in Israel...

CVE-2020-28911

Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the testserver command in ajaxhelper.php...

UBUNTU-CVE-2019-14827

A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which...

All Vulnerabilities for socijalnoukljucivanje.gov.rs Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| socijalnoukljucivanje.gov.rs ---|--- Op...

elsiglodetorreon.com.mx Cross Site Scripting vulnerability OBB-2011340

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| elsiglodetorreon.com.mx ---|--- Open Bu...

onlineservices.ipophil.gov.ph Cross Site Scripting vulnerability OBB-2007160

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| onlineservices.ipophil.gov.ph ---|---...

EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1852)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when...

GHSA-MR8H-J9CV-4M8H Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

Authentication.logout helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 Vaadin 18, and 6.0.0 through 6.0.4 Vaadin 19.0.0 through 19.0.3 uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the...