PT-2021-21590 · Unknown · Dirhistory Plugin

Name of the Vulnerable Software and Affected Versions: dirhistory plugin affected versions not specified Description: The issue concerns the widgets for navigating directory history, triggered by pressing Alt-Left and Alt-Right. These widgets use functions that unsafely execute eval on directory...

FBI Email Hoaxer ID’ed by the Guy He Allegedly Loves to Torment

Vinny Troia, the cybersecurity researcher mentioned in a fake alert gushed out to thousands of people from the FBI’s own email system on Friday night, has fingered the guy who allegedly pulled off the exploit. Register now for our LIVE event! Troia – white hat threat hunter, cybercrime investigat...

Time to Act: Bridging the Gap in Cloud Automation Adoption

Ready or not, the cloud is here. Across the board, an overwhelming majority of organizations recognize the value of the cloud. According to a recent survey conducted by Rapid7, 90% of respondents believe that cloud operations are critical to the competitiveness of their business. Analysts agree —...

Mozilla Firefox Security Advisory (MFSA2012-79) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

PT-2021-1522 · Arm +8 · Arm Cortex +9

Name of the Vulnerable Software and Affected Versions: Arm Cortex and Neoverse processors versions prior to 2022-03-08 Description: The issue is related to a hardware flaw that allows for cache speculation, also known as Spectre-BHB. An attacker can leverage the shared branch history in the Branc...

webkitgtk: User may be unable to fully delete browsing history

A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully delete the browsing history under some circumstances. The highest threat from this vulnerability is to data confidentiality...

Backdoor.Win32.VB.afu Insecure Transit

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/c6ba7fcb9eb9bdd7e081e2e84e784dcbB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.VB.afu Vulnerability: Insecure Transit Password Disclosure Description: The malware...

Mozilla Firefox Security Advisory (MFSA2016-28) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

OESA-2021-1415 storm security update

Apache Storm realtime computation system Security Fixes: An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x...

Mozilla Thunderbird < 91.3

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-50 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass...

The vulnerability of the web interface of the D-Link DIR-868LW router’s microprogramming software allows a hacker to obtain a record of user DNS requests.

The vulnerability of the web interface of D-Link DIR-868LW router software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to obtain user DNS query history...

CVE-2021-33259

Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history...

CVE-2021-33259

Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history...

CVE-2021-33259

The CVE-2021-33259 issue affects the D-Link DIR-868LW router (version 1.12b) where several web interfaces allow access without authentication. The root cause is a lack of authentication requirements for multiple web interfaces, enabling an attacker to view users’ DNS query history. Impact is expo...

PT-2021-4603

Name of the Vulnerable Software and Affected Versions D-Link DIR-868LW version 1.12b Description The issue is related to weaknesses in the authentication procedure of the D-Link DIR-868LW router's web interface. This allows a remote attacker to obtain users' DNS query history due to the lack of...

The vulnerability of the History component in the Google Chrome web browser, related to writing beyond the buffer in memory, allows attackers to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the History component in the Google Chrome web browser is related to writing beyond the buffer limit in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions through a special...

CVE-2021-38294

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Sourcing (CVE-2021-2329)

Summary An Oracle database server vulnerability has been addressed by BM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2021-2329 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the XML DB component could allow an authenticated attacker to take control of the...

Easytest SQL Injection Vulnerability (CNVD-2021-83597)

Easytest is an online learning quiz platform of China's Hua Ju Digital Technology, Inc. Easytest is vulnerable to SQL injection, which can be exploited by attackers to inject SQL commands into the parameters of the learning history page after gaining user privileges to access all databases and ga...

Easy Digital Downloads < 2.11.2.1 - Reflected Cross-Site Scripting

The plugin does not escape the start-date and end-date parameters in the payment history dashboard before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...