CVE-2021-28940

Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file, it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpiedebug.php and /scripts/magpiesimple.php page that if you send a specific https url in the RS...

SOURCEFORGE MagpieRSS 代码问题漏洞

SOURCEFORGE MagpieRSS is SOURCEFORGE open source an application . Used to parse RSS 1.0 and earlier versions of a simple , practical PHP interface . MagpieRSS 0.72 has a security vulnerability where the curl command in /extlib/Snoopy.class.inc is not validated...

CVE-2021-28373

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...

CVE-2021-28373

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...

Design/Logic Flaw

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...

CVE-2021-28373

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...

CVE-2021-28373

The vulnerability CVE-2021-28373 affects Tiny Tiny RSS (tt-rss) via the auth_internal plugin. The root issue allows an attacker to log in using an OTP code without a valid password, as reported for TT-RSS prior to 2021-03-12. The condition occurred on the git master branch for a short period; pro...

CVE-2021-28373

The authinternal plugin in Tiny Tiny RSS aka tt-rss before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in...

Tiny Tiny RSS 安全漏洞

Tiny Tiny RSStt-rss,tt-rss is an open source based browser-based news feed reader and aggregator. Tiny Tiny RSS before 2021-03-12 A security vulnerability exists that allows an attacker to log in via OTP code without a valid password...

thorn-linux

This is a Debian-based research and development platform for information security called Thorn Linux. It is designed to keep users up to date with the latest cybersecurity news while providing a hardened and anonymized penetration-testing environment. The platform includes a highly customized...

Tiny Tiny RSS - Remote Code Execution Exploit

Exploit Title: Tiny Tiny RSS - Remote Code Execution Exploit Author: Daniel Neagaru & Benjamin Nadarević Blog post: https://www.digeex.de/blog/tinytinyrss/ Software Link: https://git.tt-rss.org/fox/tt-rss Version: all before 2020-09-16 Commit with the fixes:...

Tiny Tiny RSS - Remote Code Execution

Exploit Title: Tiny Tiny RSS - Remote Code Execution Date: 21/09/2020 Exploit Author: Daniel Neagaru & Benjamin Nadarević Blog post: https://www.digeex.de/blog/tinytinyrss/ Software Link: https://git.tt-rss.org/fox/tt-rss Version: all before 2020-09-16 Commit with the fixes:...

Arbitrary Code Execution

tt-rss is vulnerable to arbitrary code execution. Lack of URL validation before requests are made allows an attacker to potentially obtain arbitrary code execution on the host OS...

Arbitrary Code Execution

tt-rss is vulnerable to arbitrary code execution. The vulnerability exists as plugins/afproxyhttp/init.php mishandles the $REQUEST"url" in an error message...

Mishandled Code

tt-rss is vulnerable to mishandled code. The vulnerability exists due to an issue was discovered in Tiny Tiny RSS aka tt-rss before 2020-09-16. The cachedurl feature mishandles JavaScript inside an SVG document...

Description of the security update for SharePoint Foundation 2013: February 9, 2021 (KB4493210)

Description of the security update for SharePoint Foundation 2013: February 9, 2021 KB4493210 Summary This security update resolves Microsoft SharePoint Spoofing Vulnerability, SharePoint Remote Code Execution Vulnerability, and SharePoint Information Disclosure Vulnerability. To learn more about...

Code injection

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278 Risk of code injection in RSSHub

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278

RSSHub is affected by a code-injection vulnerability in which certain routes use eval or the Function constructor, allowing unsafe code to be injected by a target site. The root cause is unsafe dynamic code evaluation in specific routes. The fix (version 7f1c430) temporarily removes the problemat...

Unbreakable Enterprise kernel security update

4.14.35-2025.404.1.1 - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 4.14.35-2025.404.1 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253412 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch SeongJae Par...