PT-2024-27705 · Unknown · Phpgurukul News Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul News Portal version 4.1 Description: A critical vulnerability was found in the PHPGurukul News Portal, affecting the file /admin/edit-post.php. The manipulation of the posttitle argument leads to SQL injection. The attack can be...

Crestron AM-300

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION : Low attack complexity Vendor : Crestron Equipment : AM-300 Vulnerability : OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate their privileges to root-level access. 3...

How to Enable/Disable SSH on XenServer Host

How to Enable/Disable SSH on XenServer Host...

SA44399 - 2020-03: Out-of-Cycle Advisory: Pulse Secure recommendations for Enterprise VPN Security (AA20-073A)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Many organizations are switching to alternate workplace options for employees in response to the rapidly spreading Novel Coronavirus COVID-19. Malicious cyber actors will inevitably...

CVE-2021-36503

SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file...

Rockwell Automation ISaGRAF

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: ISaGRAF Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow arbitrary code execution. 3. TECHNICAL DETAILS 3.1...

Accops HyWorks Windows Client Integer Overflow Vulnerability (CNVD-2021-100388)

Accops HyWorks is a suite of solutions consisting of software and hardware from Accops India. It is used to instantly and securely access enterprise applications remotely from anywhere, on any device and from any network. An integer overflow vulnerability exists in the Accops HyWorks Windows...

Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

RDP abused for DDoS attacks

We have talked about RDP many times before. It has been a popular target for brute force attacks for a long time, but attackers have now found a new way to abuse it. Remote access has become more important during the pandemic, with as many people as possible try to work from home. Which makes it...

HMS Networks Ewon Flexy and Cosy

1. EXECUTIVE SUMMARY CVSS v3 2.3 ATTENTION: Low skill level to exploit Vendor: HMS Networks Equipment: Ewon Flexy and Cosy Vulnerability: Permissive Cross-domain Policy with Untrusted Domains 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to retrieve...

Grundfos CIM 500

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Grundfos Pumps Corporation Equipment: CIM 500 Vulnerabilities: Missing Authentication for Critical Function, Unprotected Storage of Credentials 2. RISK EVALUATION Successful exploitation of these...

Helping Remote Workers Overcome Remote Attacks

Cybercriminals are experts at making the most of whatever they’re given. The current pandemic is no different, and they have been quick to profit from their victims’ fears. Adaptability has always been the hallmark of malicious actors, and the proliferation of “remote-everything” attacks is a pri...

Enterprise VPN Security

Summary As organizations prepare for possible impacts of Coronavirus Disease 2019 COVID-19, many may consider alternate workplace options for their employees. Remote work options—or telework—require an enterprise virtual private network VPN solution to connect employees to an organization’s...

Schneider Electric Modicon Controllers (Update A)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

NetComm Wireless 4G LTE Light Industrial M2M Router

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: NetComm Wireless Equipment: 4G LTE Light Industrial M2M Router Vulnerabilities: Information Exposure, Cross-site Request Forgery, Cross-site Scripting, Information Exposure through Directory Listin...

CVE-2016-4451

The 1 Organization and 2 Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that...

Sun Java系统目录代理服务器远程非授权访问漏洞

BUGTRAQ ID: 28941 Sun Java系统目录服务器是Java企业系统的一个组件，为企业管理大量用户信息提供用户管理基础架构。 Sun Java系统目录代理服务器错误的基于bind-dn标准对连接进行分类，导致应用了错误的策略，成功利用这个漏洞可能允许远程非特权用户获得对服务器的非授权管理访问。 Sun Java System Directory Server 6.2 Sun Java System Directory Server 6.1 Sun Java System Directory Server 6.0 Sun ---...

[SECURITY] [DSA 651-1] New squid packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 651-1 [email protected] http://www.debian.org/security/ Martin Schulze January 20th, 2005 http://www.debian.org/security/faq -...

ISS Protection Brief: Checkpoint VPN-1 ASN.1 Decoding Remote Compromise

-----BEGIN PGP SIGNED MESSAGE----- nternet Security Systems Protection Brief July 28, 2004 Check Point VPN-1 ASN.1 Decoding Remote Compromise Summary: ISS has shipped protection for a flaw X-Force has discovered in CheckPoint VPN-1 Server. The Check Point VPN-1 product is widely relied upon to...

[NEWS] SMC Routers Passwordless Remote Administration

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...