Oracle Database Weak NNE Integrity Key Derivation Vulnerability

NNE's integrity protection mechanism deliberately weakens the key used for computing per-packet message authentication codes MACs. Oracle Database versions 19c, 12.2.0.1, and 12.1.0.2 are affected. Product: Database Manufacturer: Oracle Affected Versions: 12.1.0.2, 12.2.0.1, 19c Tested Versions:...

PHP Event Calendar Lite Edition SQL Injection Vulnerability

Product: PHP Event Calendar Manufacturer: Kayson Group Ltd. Affected Versions: PHP Event Calendar Lite edition Tested Versions: PHP Event Calendar Lite edition Vulnerability Type: SQL injection CWE-89 Risk Level: High Solution Status: Closed Manufacturer Notification: 2021-08-09 Solution Date:...

PHP Event Calendar Lite Edition SQL Injection

Advisory ID: SYSS-2021-048 Product: PHP Event Calendar Manufacturer: Kayson Group Ltd. Affected Versions: PHP Event Calendar Lite edition Tested Versions: PHP Event Calendar Lite edition Vulnerability Type: SQL injection CWE-89 Risk Level: High Solution Status: Closed Manufacturer Notification:...

Tiny Java Web Server 1.115 Cross Site Scripting

Advisory ID: SYSS-2021-042 Product: Tiny Java Web Server and Servlet Container TJWS Manufacturer: D. Rogatkin Affected Versions: = 1.115 Tested Versions: 1.107, 1.114 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2021-07-21...

WordPress Admin Columns Plugin Cross Site Scripting Vulnerability

Product: Admin Columns WordPress Plug-In Manufacturer: Codepress Affected Versions: 5.5.2 Pro version, 4.3.2 Free version Tested Versions: 5.5.1 Pro version, 4.3 Free version Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: High Solution Status: Fixed Manufacturer Notification:...

WordPress Admin Columns Cross Site Scripting

Advisory ID: SYSS-2021-032 Product: Admin Columns WordPress Plug-In Manufacturer: Codepress Affected Versions: 5.5.2 Pro version, 4.3.2 Free version Tested Versions: 5.5.1 Pro version, 4.3 Free version Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: High Solution Status: Fixed...

Zoom 5.4.3 (54779.1115) / 5.5.4 (13142.0301) Information Disclosure

Advisory ID: SYSS-2020-044 Product: Zoom Manufacturer: Zoom Video Communications, Inc. Affected Versions: 5.4.3 54779.1115 5.5.4 13142.0301 Tested Versions: 5.4.3 54779.1115 5.5.4 13142.0301 Vulnerability Type: Exposure of Resource to Wrong Sphere CWE-668 Risk Level: Medium Solution Status: Open...

Zoom 5.4.3 (54779.1115) / 5.5.4 (13142.0301) Information Disclosure Vulnerability

Manufacturer: Zoom Video Communications, Inc. Affected Versions: 5.4.3 54779.1115 5.5.4 13142.0301 Tested Versions: 5.4.3 54779.1115 5.5.4 13142.0301 Vulnerability Type: Exposure of Resource to Wrong Sphere CWE-668 Risk Level: Medium Solution Status: Open Manufacturer Notification: 2020-12-02...

Zoom Screen-Sharing Glitch ‘Briefly’ Leaks Sensitive Data

A security blip in the current version of Zoom could inadvertently leak users’ data to other meeting participants on a call. However, the data is only leaked briefly, making a potential attack difficult to carry out. The flaw CVE-2021-28133 stems from a glitch in the screen sharing function of...

URVE Software Build 24.03.2020 Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-042 Product: URVE Software Manufacturer: Eveo Sp. z o.o. Affected Versions: Build "24.03.2020" Tested Versions: Build "24.03.2020" Vulnerability Type: Cleartext Storage of Sensitive Information CWE-312 Exposure of Sensitive...

URVE Software Build 24.03.2020 Missing Authorization

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-041 Product: URVE Software Manufacturer: Eveo Sp. z o.o. Affected Versions: Build "24.03.2020" Tested Versions: Build "24.03.2020" Vulnerability Type: Missing Authorization CWE-862 Risk Level: High Solution Status: Open...

URVE Software Build 24.03.2020 Authentication Bypass / Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-040 Product: URVE Software Manufacturer: Eveo Sp. z o.o. Affected Versions: Build "24.03.2020" Tested Versions: Build "24.03.2020" Vulnerability Type: Missing Authentication for Critical Function CWE-306 Risk Level: High...

MailDepot 2033 2.3.3022 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2020-037 Product: MailDepot Manufacturer: REDDOXX GmbH Affected Versions: 2033 2.3.3022 Tested Versions: 2033 2.3.3022 Vulnerability Type: Persistent Cross-site Scripting CWE-79 Risk Level: High Solution Status: Open Manufacturer...

DOMOS 5.8 Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-025 Product: DOMOS Manufacturer: Secudos GmbH Affected Versions: = DOMOS 5.8 Tested Versions: DOMOS 5.8 Vulnerability Type: OS Command Injection CWE-78 Risk Level: Low Solution Status: Solved Manufacturer Notification:...

Qiata FTA 1.70.19 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-024 Product: Qiata FTA Manufacturer: Secudos GmbH Affected Versions: ' by flipping the direction of the special character. Also, quotation marks are escaped properly. An attacker can use the behavior to construct a malicious...

Exploit for OS Command Injection in Secudos Domos

CVE-2020-14293 This vulnerablity was discovered and disclosed...

Exploit for Path Traversal in Inneo Startup_Tools

CVE-2020-15492 This vulnerablity was discovered and disclosed...

ABUS Secvest Hybrid Module FUMO50110 Authentication Bypass Vulnerability

ABUS Secvest Hybrid module FUMO50110 suffers an authentication bypass vulnerability. The hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged between the ABUS Secvest alarm panel and the ABUS Secvest Hybrid module. Thus, an...

INNEO Startup TOOLS 2018 M040 13.0.70.3804 Remote Code Execution

Exploit Title: INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution Date: 2020-07-23 Exploit Author: Patrick Hener, SySS GmbH Many credits go to Dr. Benjamin Heß, SySS GmbH for helping with php oddities and the powershell payload Advisory: SYSS-2020-028...

INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution Exploit

Exploit for multiple platform in category web applications Exploit Title: INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution Exploit Author: Patrick Hener, SySS GmbH Many credits go to Dr. Benjamin Heß, SySS GmbH for helping with php oddities and the powershell payload Advisory:...