python-urllib3: CRLF injection via HTTP request method

A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrit...

ImpressCMS: SQL Injection through /include/findusers.php

Summary: The vulnerability is located in the /include/findusers.php script: 281. $total = $userhandler-getUserCountByGroupLink@$POST"groups", $criteria; 282. 283. $validsort = array"uname", "email", "lastlogin", "userregdate", "posts"; 284. $sort = !inarray$POST'usersort', $validsort ? "uname" :...

postgresql: psql's \gset allows overwriting specially treated variables

A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses \gset when querying a compromised server, this flaw allows an attacker to execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to...

PayloadsAllTheThings

It is an offensive tool for general-purpose. This repository contains a collection of payloads for various purposes, including exploitation and testing. The payloads are not specifically tied to a particular CVE or GHSA ID. The target product/service or framework is not explicitly stated, but the...

K55 - Linux X86_64 Process Injection Utility | Manipulate Processes With Customized Payloads

pronounced: "kay fifty-five" The K55 payload injection tool is used for injecting x8664 shellcode payloads into running processes. The utility was developed using modern C++11 techniques as well as some traditional C linux functions like ptrace. The shellcode spawned in the target process is 27...

Nagios XI Remote Code Execution Vulnerability

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A remote code execution vulnerability exists in the "Manage Plugins" page in Nagios XI versions prior to 5.8.0. The vulnerability stem...

CVE-2020-35578

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands...

CVE-2020-35578

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands...

GHSA-WW4J-C2RQ-47Q8 Command injection in ts-process-promises

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js...

Cisco Anyconnect Secure Mobility Client 权限许可和访问控制问题漏洞

The Cisco AnyConnect Secure Mobility Client is a virtual private network VPN client for a variety of operating systems and hardware configurations. An arbitrary file read vulnerability exists in the upgrade component of the Cisco AnyConnect Secure Mobility Client, which can be exploited by a...

[SECURITY] Fedora 33 Update: flac-1.3.3-4.fc33

FLAC stands for Free Lossless Audio Codec. Grossly oversimplified, FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, flac, a command-line program to encode and decode FLAC files, metaflac, a command-line...

[SECURITY] Fedora 33 Update: awstats-7.8-2.fc33

Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy server...

Hotfix XS82E010 - for Citrix Hypervisor 8.2

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. All customers who are affected by the issues described inCTX285937 - Citrix Hypervisor Multiple Security Updatesshould install this hotfix. Information About this Hotfix Component| Details ---|---...

Radarsu Ts-process-promises Command Injection Vulnerability

Radarsu Ts-process-promises is a Javascript-based application for executing shell commands with cached output by the individual developers at Radarsu. Ts-process-promises is vulnerable to a command injection vulnerability with an injection point at line 45 of lib/process-promises.js...

Hotfix XS81E014 - For Citrix Hypervisor 8.1

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.1. All customers who are affected by the issues described inCTX286756 - Citrix Hypervisor Multiple Security Updatesshould install this hotfix. Note: This hotfix is available only to customers on theCustomer...

The vulnerability of the command-line interface of the Cisco Connected Mobile Experiences software allows a hacker to escalate their privileges and gain access to the isolated software environment.

The vulnerability of the command-line interface of the Cisco Connected Mobile Experiences software relates to errors in privilege management. Exploiting this vulnerability can allow attackers to enhance their privileges and gain access to the isolated software environment...

pwntools

This repository is an offensive tool for binary exploitation. The primary vulnerability targeted by this tool is not explicitly stated in the provided context, but the tool is designed for binary exploitation, which suggests that it may be targeting a vulnerability that allows for code execution ...

PhpList SQL注入漏洞

phpList is an open source newsletter and email marketing software from phpList UK. A SQL injection vulnerability exists in phpList 3.5.9. The vulnerability can be exploited to inject SQL queries via the attribute on line 4 of the "Config - Import Administrators" page...

[SECURITY] Fedora 32 Update: pngcheck-2.4.0-5.fc32

pngcheck verifies the integrity of PNG, JNG and MNG files by checking the internal 32-bit CRCs checksums and decompressing the image data; it can optionally dump almost all of the chunk-level information in the image in human-readable form. For example, it can be used to print the basic statist i...

Google Http package For Dart 注入漏洞

Google Http package For Dart is a U.S. Google Inc. for the Dart programming language Http support code base . A cross-site request forgery vulnerability exists in Google Http package For Dart version 0.12.2 and earlier versions, which allows an attacker to implement a CRLF injection into an HTTP...