IT threat evolution Q2 2021

Targeted attacks The leap of a Cycldek-related threat actor It is quite common for Chinese-speaking threat actors to share tools and methodologies: one such example is the infamous "DLL side-loading triad": a legitimate executable, a malicious DLL to be side-loaded by it and an encoded payload,...

CVE-2021-37391

A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social...

perl bug fix and enhancement update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Bug Fixes and Enhancements: perl-net-ping wrong return value on failing DNS name lookup BZ1973176...

perl bug fix and enhancement update

An update is available for perl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Perl is a high-level programming language that is commonly used for system...

DEBIAN-CVE-2021-38166

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAPSYSADMIN capability...

CVE-2020-21357

A stored cross site scripting XSS vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field...

Privilege Escalation

com.liferay.dynamic.data.mapping.service is vulnerable to Privilege Escalation. The vulnerability exists due to the lack of sanitization of user permission, which allows an attacker to view all forms and form entries via the form section in the site administration...

The vulnerability of the Moodle administration system, related to the lack of measures taken to protect the website structure, allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of the Moodle administration system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the Moodle administration system, related to insufficient validation of input data, allows a perpetrator to obtain confidential information.

The vulnerability of the Moodle administration system is related to insufficient verification of entered data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information...

The vulnerability of the Moodle administration system, related to errors in processing hypertext links, allows a hacker to bypass security measures.

The vulnerability of the Moodle administration system is related to errors in processing hypertext links. Exploiting this vulnerability could allow a malicious actor to bypass security features remotely...

The vulnerability of the Moodle administration system, related to insufficient validation of input data, allows a perpetrator to obtain confidential information.

The vulnerability of the Moodle administration system is related to insufficient verification of entered data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information...

Pulse Connect Secure < 9.1R12 (SA44858)

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is prior to 9.1R12. It is, therefore, affected by multiple vulnerabilities, including: - A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perfo...

copy paste error in _batchConfirmOutstandingPendingActions

Handle gpersoon Vulnerability details Impact The function batchConfirmOutstandingPendingActions of LongShort.sol processeses the variable batchedamountSyntheticTokentoShiftAwayFrommarketSide, and sets it to 0 after processing. However probably due to a copy/paste error, in the second instance,...

WordPress The Community Events plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Community Events plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in...

The vulnerability of the Moodle administration system, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the Moodle administration system is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...

The vulnerability of the Moodle administration system, related to the lack of measures taken to protect the website structure, allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of the Moodle administration system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

WordPress Secure Copy Content Protection Plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Secure Copy Content Protection plugin is an application plugin for WordPress. A SQL injection vulnerability exists in...

CVE-2021-33334

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to vi...

Design/Logic Flaw

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to vi...

CVE-2021-33324

The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration...