CVE-2021-33514

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTPUSERAGENT;' with an OS command in the User-Agent field. This affects GC108P before...

Remote Code Execution (RCE)

Smarty is vulnerable to remote code execution. The library does not properly handle the illegal function names in function name='blah'/function, allowing a malicious user to inject and execute arbitrary commands...

CVE-2020-27261

The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code...

Prototype Pollution in patrickleet/expand-keys

Description expand-keys is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var expandKeys = require"expand-keys" console.log"Before : " + .polluted; expandKeys"proto.polluted": "Yes! Its Polluted" console.log"After : " + .polluted; 2. Execute the...

CVE-2020-27903

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.0.1. An application may be able to gain elevated privileges...

Command injection

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request to test if email credentials and hostname sent to the device work...

Semmle: All Burp Suite Scan report

Summary: 1. Detected Deserialization RCE: Jackson 1.1. https://lgtm-com.pentesting.semmle.net/blog/ lgtmshortsession cookie 1.2. https://lgtm-com.pentesting.semmle.net/internalapi/v0.2/getSuggestedProjects apiVersion parameter 2. Session token in URL 3. CSP: Inline scripts can be inserted 3.1...

Denial Of Service (DoS)

libglusterfs.so is vulnerable to denial of service DoS attacks. The library contains a memory leak in the client code when the fsync2 system call is used, allowing a malicious user to cause a DoS condition by consuming the system's memory...

Cisco WebEx Recorder and Player ATDL2006 Decompression Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Cisco WebEx Recorder and Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2018-16779

BlogCMS through 2016-10-25 has XSS via a comment...

CVE-2017-8954

A Remote Code Execution vulnerability in HPE Intelligent Management Center iMC PLAT version 7.2 was found...

Authorization Bypass

bolt is vulnerable to authorization bypasses. The attack is possible because the library does not restrict access requests to profiler routes, allowing an attacker access to sensitive information...

Authorization Bypass

schmittjoh/serializer is vulnerable to authorization bypass. The library ignores the context groups that specify the types of data that can be deserialized. This is only applicable when the groups function is used to specify what data can be deserialized...

Authentication Bypass

cas-server-core-authentication is vulnerable to authentication bypass. The library does read the correct value when checking for a attribute bypass, causing any principle with the bypass.principalAttributeName attribute to be able to bypass multifactor authentication...

Regular Expression Denial Of Service (ReDoS)

marked is vulnerable to regular expression denial of service ReDoS attacks. An attacker can pass a markdown file to the library that when parsed can cause the system to slowdown and cause a ReDoS...

AZL-36952 CVE-2017-11551 affecting package libid3tag for versions less than 0.16.3-7

The id3fieldparse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service OOM via a crafted MP3 file...

McAfee Security Scan Plus - Remote Command Execution

Vulnerability Summary The following advisory describes a Remote Code Execution found in McAfee Security Scan Plus. An active network attacker could launch a man-in-the-middle attack on a plaintext-HTTP response to a client to run any residing executables with privileges of a logged in user. McAfe...

AZL-34918 CVE-2017-3609 affecting package libdb for versions less than 5.3.28-7

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

Horos Remote Memory Corruption Vulnerability

Horos is an open source free DICOM medical image viewer. A remote memory corruption vulnerability exists in Horos version 2.1.0, which stems from the program's use of a vulnerable library and can be exploited by an attacker to cause a denial of service memory corruption...

PortSwigger Web Security: XSS in IE11 on portswigger.net via Flash

Hello Portswigger Security Team, There is a reflective XSS vulnerability in portswigger.net. The flash file https://portswigger.net/burp/tutorials/video-js/video-js.swf is from an old video.js library version 3.2.0 which is vulnerable to XSS. This XSS will be blocked by CSP instruction object-src...