CVE-2021-40531

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app...

Remote code execution

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app...

Modicon BMXNOR0200H Privilege Escalation

The vulnerability of the RTU module’s microprogramming software, Modicon BMXNOR0200H, is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker operating remotely to enhance their privileges...

Schneider Electric HMI Terminal Code Execution

The vulnerability of the Ethernet Download function in Schneider Electric’s HMI terminal configuration software, EcoStruxure Operator Terminal Expert, and the SCADA software Pro-face BLUE is related to insufficient validation of input data. Exploiting this vulnerability could allow a remote...

[SECURITY] Fedora 34 Update: rust-tui-0.15.0-2.fc34

Library to build rich terminal user interfaces or dashboards...

[SECURITY] Fedora 34 Update: rust-gitui-0.16.2-2.fc34

Blazing fast terminal-ui for git...

Fedora: Security Advisory for rust-gitui (FEDORA-2021-3cf88e44b4)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Moderate: Red Hat Enhancement Advisory: Web Terminal 1.3 release

Web Terminal 1.3 has been released. Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed. The Web Terminal 1.3 release provides the following fixes and new features:...

CVE-2021-37840

aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking CSWH involving OS commands within WebSocket messages at a ws:// URL for /webssh the victim must have configured Terminal with at least one host. Successful exploitation depends on the browser used by a potential victim e.g., exploitatio...

Cross site scripting

aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking CSWH involving OS commands within WebSocket messages at a ws:// URL for /webssh the victim must have configured Terminal with at least one host. Successful exploitation depends on the browser used by a potential victim e.g., exploitatio...

PT-2021-21882

Name of the Vulnerable Software and Affected Versions: aaPanel versions 6.8.12 and earlier Description: The issue involves Cross-Site WebSocket Hijacking CSWH where an attacker can execute OS commands within WebSocket messages at a ws:// URL for /webssh. This can happen if the victim has configur...

Schneider Electric Easergy T200 product access control vulnerability

Schneider-electric Schneider Electric Easergy T200 is a remote control terminal for medium/low voltage substations from Schneider-electric, France. An access control error vulnerability exists in several Schneider Electric products due to a lack of valid authorized operation of the product and...

[ASA-202107-34] code: arbitrary code execution

Arch Linux Security Advisory ASA-202107-34 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-31211 CVE-2021-31214 Package : code Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1963 Summary ======= The package co...

openSUSE 15 Security Update : libX11 (openSUSE-SU-2021:1897-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1897-1 advisory. - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor...

SQL Injection Vulnerability in iDS Networked Digital Signage Management System of Shenzhen Bright Diamond Technology Co.

iDS Networked Digital Signage Management System is a kind of digital signage management system that can be used for program management and terminal management. iDS Networked Digital Signage Management System of Shenzhen Bright Diamond Technology Co., Ltd. suffers from SQL injection vulnerability,...

The Cloud in the clouds

Heading back to the airport to sit in another 747 pilot seat chair is always exciting. After our first research session on a grounded airplane this time we spent more time looking at the IFE In-Flight Entertainment system. We found very different results from the first plane. Rather than an old...

Unauthorized Access Vulnerability in CDF Computer Terminal Confidential Inspection System

ZF Computer Terminal Confidentiality Inspection System is a security product for grassroots confidential cadres and classified personnel at all levels to carry out security and confidentiality inspections and self routine inspections, which provides a powerful technical means for the...

Exploit for OS Command Injection in Docker

🖥️ -h3x0v3rl0rd- ️⃣ CVE-2019-5736 Usage : machine is vuln...

Advisory ROSA-SA-2021-1920

Software: minicom 2.6.2 OS: Cobalt 7.9 CVE-ID: CVE-2017-7467 CVE-Crit: CRITICAL CVE-DESC: A buffer overflow error was detected in the way minicom pre-2.7.1 handled VT100 escape sequences. A malicious terminal device could potentially exploit this vulnerability to crash minicom or execute arbitrar...

GHSA-C38G-469G-CMGX Improper Neutralization of Special Elements in Output in helm.sh/helm/v3

Since Helm 2 was released, a well-documented aspect of Helm is that the Helm chart's version number MUST follow the SemVer2 specification. In the past, Helm would not permit charts with malformed versions. At some point, a patch was merged that changed this - On a version parse error, the version...