CVE-2020-14075

Summary (CVE-2020-14075) TRENDnet TEW-827DRU routers (firmware up to 2.06B04) have a command-injection vulnerability in apply.cgi. The flaw is triggered by the actions pppoe_connect, ru_pppoe_connect, or dhcp_connect using the key wan_ifname (or wan0_dns), enabling an authenticated user to execut...

CVE-2020-14081

TRENDnet TEW-827DRU routers (firmware up to 2.06B04) contain a command injection in apply.cgi via the action send_log_email using the auth_acname or auth_passwd parameter. An authenticated user can execute arbitrary commands on the device. The affected component is the apply.cgi handling in TEW-8...

GitHub Security Lab: CodeQL query for SpEL injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect Server-Side Template Injections (JavaScript)

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query for MVEL injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect JNDI injections

This bug was reported directly to GitHub Security Lab...

Silent Night Banking Trojan Charges Top Dollar on the Underground

A descendant of the infamous Zeus banking trojan, dubbed Silent Night by the malware’s author, has emerged on the scene, with a host of functionalities available in a spendy malware-as-a-service MaaS model. Custom builds can run as much as $4,000 per month to use, which researchers say is now...

CVE-2020-11942

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

CVE-2020-11942

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

CVE-2020-11942

Open-AudIT 3.2.2 contains SQL injection in device scripts via unsanitized parameters system.class and system.discovery_id, enabling an attacker to modify or execute arbitrary SQL statements (e.g., via crafted requests to /devices). PoC shows TRUE/FALSE payloads returning different response sizes,...

Duplicate Page and Post < 2.5.7 & WP Post Page Clone < 1.1 - SQL Injections due to Duplicated Snippets

SQL Injections in the Duplicate Post, WP Post Page Clone, Duplicate Page and Post plugins, due to using the snippet piece of code. The issue in the duplicate-post was already added, at https://wpvulndb.com/vulnerabilities/9251...

Updated phpmyadmin packages fix security vulnerability

Some SQL injections via table names and parameters were fixed...

CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS...

CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS...

CVE-2019-14905

The CVE-2019-14905 issue affects Ansible Engine’s nxos_file_copy module, where the filename parameter could be crafted to inject OS commands on NXOS devices. This is a local attack with potential confidentiality, integrity, and availability impacts as described (loss of confidentiality, etc.). Af...

CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS...

CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS...

CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS...

WordPress, Apache Struts Attract the Most Bug Exploits

WordPress and Apache Struts vulnerabilities were the most-targeted by cybercriminals in web and application frameworks in 2019 – while input-validation bugs edged out cross-site scripting XSS as the most-weaponized weakness type. That’s according to the RiskSense Spotlight Report, which analyzed...

CVE-2020-3922

CVE-2020-3922 affects LisoMail by ArmorX. The vulnerability is an SQL injection via a URL parameter manipulation that allows attackers to access the database without authentication. According to the supplied data, CVSS vectors indicate a NETWORK attack with HIGH/CRITICAL impact (CVSS v3.1: 9.8; c...