CVE-2021-43798

Grafana CVE-2021-43798 is a directory traversal vulnerability affecting Grafana 8.0.0-beta1 through 8.3.0 (excluding patched versions). The flaw allows access to local files via the vulnerable URL path /public/plugins/ and related API paths described in the advisories. Upstream fixes were release...

CVE-2021-43798

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 except for patched versions iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: /public/plugins//, where is the plugin ID for any installe...

Librenms path traversal vulnerability

Librenms is a Librenms community of open source network monitoring system based on PHP and MySQL. The system features custom alerts, automatic discovery of network environments and automatic updates.Librenms suffers from a path traversal vulnerability that stems from Librenms 21.11.0 being affect...

Cross site request forgery (csrf)

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawktosetwidget and tawktoremovewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users including simple subscribers to change the...

Squaredup 代码问题漏洞

Squaredup is a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments. SSRF vulnerabilities exist in SquaredUp for SCOM, and no detailed vulnerability details are available...

JetBrains YouTrack Injection Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. The software has features such as bug tracking, creating workflows, and monitoring project progress.JetBrains YouTrack is vulnerable to an injection vulnerability that stems from...

Structured threat hunting: One way Microsoft Threat Experts prioritizes customer defense

Todays threat landscape is incredibly fast-paced. New campaigns surface all the time, and the amount of damage that they can cause is not always immediately apparent. Security operations centers SOCs must be equipped with the tools and insight to identify and resolve potentially high-impact threa...

Invisible rat: how Sentry, Datadog, and others used by XSS and JavaScript malware

We all know how it’s convenient to use tools like Sentry or Datadogs for JavaScript events monitoring. It allows to catch errors in real-time, organize and manage issues resolution process, and genuinely shift left operations to developers. But Wallarm security experts warn of dangerous patterns ...

Librenms Cross-Site Scripting Vulnerability (CNVD-2021-95231)

Librenms is a PHP and MySQL based open source network monitoring system for the Librenms community. The system features custom alerts, auto-discovery of network environments, and automatic updates.Librenms suffers from a cross-site scripting vulnerability that originates in...

Librenms Cross-Site Scripting Vulnerability (CNVD-2021-95230)

Librenms is a Librenms community PHP and MySQL-based open source network monitoring system . The system features custom alerts, auto-discovery of network environments and automatic updates.Librenms version 21.11.0 has a cross-site scripting vulnerability that can be exploited by attackers via...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox

Summary IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox. Vulnerability Details CVEID: CVE-2021-29976 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within...

Researchers Have a Method to Spot Reddit’s State-Backed Trolls

Academics claim they can sniff out the telltale signs of troll-like behavior. But is it really as simple as monitoring cute animal postings?...

The vulnerability of the monitoring software for PLK devices from Fuji Electric, V-Server Lite and Tellus Lite V-Simulator, arises from the possibility of executing arbitrary code or triggering a service failure when a write operation occurs outside the buffer in memory.

The vulnerability of the monitoring software for PLK devices from Fuji Electric, V-Server Lite and Tellus Lite V-Simulator, lies in the fact that the recording operation goes beyond the buffer boundaries into memory during the syntactic analysis of V9 files in the V-Simulator module. Exploiting...

The vulnerability in the implementation of the executable file C:\R-SeeNet\apache\bin\httpd.exe, a monitoring software for routers of the Advantech R-SeeNet series, allows a perpetrator to gain elevated privileges.

The vulnerability of the executable file C:\R-SeeNet\apache\bin\httpd.exe, which is used by the monitoring software for routers of the Advantech R-SeeNet family, is related to deficiencies in access control to the C:\R-SeeNet directory. Exploiting this vulnerability could allow an attacker to...

Slippage protection

Handle pauliax Vulnerability details Impact functions buyMalt and sellMalt, and removeLiquidity have no slippage protection and addLiquidity hardcodes it to 5%: 0, // amountOutMin Mempool snipers can profit from that by monitoring the chain and sandwiching these functions. Now it is left for the...

RewardReinvestor Is Vulnerable To Sandwich Attacks

Handle leastwood Vulnerability details Impact The splitReinvest function in RewardReinvestor is called upon by bonded users. An attacker can monitor the blockchain for calls to this function and launch a sandwich attack in combination with a flash loan to steal funds. A malicious user is...

Qnap Qvr 操作系统命令注入漏洞

Qnap Qvr is a Qnap monitoring system control center from China Weilian Technology Qnap. An operating system command injection vulnerability exists in the QNAP appliance VioStor, which allows remote attackers to run arbitrary commands. We have fixed this vulnerability in the following QVR versions...

Advantech R-SeeNet SQL Injection Vulnerability (CNVD-2021-93826)

Advantech R-SeeNet is an industrial monitoring software from Advantech Taiwan. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet is vulnerable to SQL injection, which is caused by insufficient cleaning of...

Advantech R-SeeNet SQL Injection Vulnerability (CNVD-2021-92432)

Advantech R-SeeNet is an industrial monitoring software from Advantech Taiwan. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet is vulnerable to a SQL injection vulnerability due to insufficient cleaning of...

Advantech R-SeeNet elevation of privilege vulnerability (CNVD-2021-90865)

Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms. Advantech R-SeeNet has a security vulnerability that can be exploited by attackers to escala...