CVE-2020-15183 Reflected XSS leading to RCE in SoyCMS

SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting XSS which leads to Remote Code Execution RCE from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage...

hexo-wustxiao-blog (1.1.1) potentially affected by unknown CVE via hexo-admin (2.3.0)

hexo-admin NPM version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on hexo-admin and may be impacted: - hexo-wustxiao-blog 1.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-PHPH-XPJ4-WVCV...

nineone152 (>=1.1.9, <=1.1.11) potentially affected by unknown CVE via node-ftp (0.0.1-security)

node-ftp NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on node-ftp and may be impacted: - nineone152 =1.1.9, =1.1.11 Source cves: unknown CVE Source advisory: OSV:GHSA-5JGP-PG4F-Q8VJ...

jackson-mapper-asl: XML external entity similar to CVE-2016-3720

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...

@24hr/rawb-search (>=0.10.1, <=0.29.10), @aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3) +58 more potentially affected by unknown CVE via apollo-server (>=2.0.0, <=2.14.1)

apollo-server NPM version =2.0.0, =0.10.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =2018.8.29-0, =2018.8.28-0, =0.5.7, =1.0.0, =0.0.1-alpha.44, =0.4.0, =0.0.0-d99f4ac.0, =1.27.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

berkano:berkano-bookmarks (>=dev-20050722, <=20050901-2), br.com.thiagomoreira.bancodobrasil:credit-card-report-converter (>=0.1, <=1.0.0) +213 more potentially affected by unknown CVE via freemarker:freemarker (>=2.3.1, <=2.3.9)

freemarker:freemarker MAVEN version =2.3.1, =dev-20050722, =0.1, =1.7.0, =0.1, =0.1.3, =2.0.4, =1.0.0.release, =9.00.2110.07.220316, =9.00.2112.03.220528 - com.github.youribonnaffe.gradle.format:com.github.youribonnaffe.gradle.format.gradle.plugin 1.2 - com.gnizr:gnizr-robot 2.4.0-m4 -...

BYO-Bug Tactic Attacks Windows Kernel with Outdated Driver

The operators behind the RobbinHood ransomware are using a vulnerable, legacy driver from Taiwan-based motherboard manufacturer Gigabyte in order to get around antivirus protections. The “bring-your-own-bug” tactic is likely to crop up in other attacks going forward, according to security analyst...

CVE-2019-7959

Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability. Successful exploitation could lead to arbitrary code execution...

Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities (patch) vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1000156 DESCRIPTION: GNU Patch could allow a remote attacker to execute arbitrary code on the system, caused by an input validation error when processing patch files. An attacker could...

Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities (Apache Struts) vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An...

CVE-2018-15964

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure...

Information disclosure

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure...

Design/Logic Flaw

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to arbitrary file overwrite...

CVE-2018-15964

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure...

CVE-2018-15964

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure...

CVE-2018-12828

Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. Successful exploitation could lead to privilege escalation...

CVE-2018-12828

Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. Successful exploitation could lead to privilege escalation...

Privilege escalation

Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. Successful exploitation could lead to privilege escalation...

ASUSWRT 3.0.0.4.376_1071 - LAN Backdoor Command Execution

漏洞概要2014年10月3日，国外安全研究员Joshua J. Drake在他github（https://github.com/jduck）提交了针对华硕路由器的一个远程命令执行漏洞poc（https://github.com/jduck/asus-cmd）。该漏洞随后被编号为CVE-2014-9583。知道创宇安全研究团队在第一时间对该命令执行漏洞进行了研究和分析。a 漏洞描述华硕路由器R系列路由器使用开源路由器系统 Asuswrt，开源代码给我们随后的漏洞分析带来很多方便，不用逆向分析。在Asuswrt中存在 infosvr 进程，该进程监听在0.0.0.0...

Adobe Reader/Acrobat 'U3D' Component Memory Corruption Vulnerability (APSA11-04, APSB11-30) - Mac OS X

Adobe Reader/Acrobat is prone to a memory corruption vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...