CVE-2020-7868

CVE-2020-7868 affects HelpU’s remote administration tool (helpUS). The vulnerability arises from improper validation of parameters in the ShellExecutionExA function during login, enabling remote code execution. Public sources in the connected documents confirm the issue but do not provide exploit...

Cross-Site Scripting (XSS)

shopware/shopware is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via administration...

CVE-2021-32713

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overvi...

Cross site scripting

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overvi...

CVE-2021-32713 Authenticated Stored XSS

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overvi...

PT-2021-19880 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.4.1.1 Description: The admin API has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommended to update to version 6.4.1.1. The update to 6.4.1.1 can ...

Shopware 跨站脚本漏洞

Shopware is an open source e-commerce platform. A cross-site scripting vulnerability exists in Shopware versions prior to 5.6.10. An attacker can exploit this vulnerability to inject malicious script into Administration to execute client-side code...

GetSimple CMS Cross-Site Scripting Vulnerability (CNVD-2021-45144)

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/snippets.php in GetSimple CMS version 3.4.0a. An attacker can exploit this vulnerability via Add Snippet and Save snippets to conduct cross-site...

ArubaOS-Switch Multiple Vulnerabilities (ARUBA-PSA-2020-007)

The version of ArubaOS-Switch installed on the remote host is 16.08. prior to version 16.08.0009, 16.09. prior to 16.09.0007 or 16.10. prior to 16.10.0003. It is, therefore, affected by multiple vulnerabilities, as follows: - A vulnerability in the Web Management Interface allows an attacker to...

CiviCRM 5.22.0 - Code Execution Vulnerability Chain Explained

During our vulnerability research on the largest CMS systems we came across CiviCRM last year. It’s an open source CRM plugin for the most popular CMS systems like Wordpress, Joomla, Drupal, and Backdrop. CiviCRM is specifically designed for the needs of non-profit, non-governmental, and advocacy...

Security Bulletin: A Security Vulnerability in IBM Java Runtime affect IBM License Key Server Administration and Reporting Tool and its Agent

Summary A security vulnerability has been found in the IBM® Runtime Environment Java™ used by IBM License Key Server Administration and Reporting Tool and its Agent. A fix has been published to mitigate the same. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerabilit...

Avaddon Ransomware Gang Evaporates Amid Global Crackdowns

Ransomware group Avaddon has decided to shutter its criminal enterprise after landing in the crosshairs of law-enforcement agencies in the U.S. and Australia. Avaddon, a prolific ransomware-as-a-service RaaS provider, released its decryption keys to BleepingComputer — 2,934 in total — with each k...

EC-CUBE cross-site scripting vulnerability (CNVD-2021-51324)

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in EC-CUBE, which can be exploited by an attacker to inject arbitrary scripts by performing specific actions on the administration page of EC-CUBE...

Ec-cube 跨站脚本漏洞

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in EC-CUBE, which can be exploited by an attacker to inject arbitrary scripts by performing specific actions on the administration page of EC-CUBE...

Backdoor.Win32.Zombam.gen Information Disclosure

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ff6516c881dee555b0cd253408b64404D.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.gen Vulnerability: Information Disclosure Description: Zombam malware listens...

Solar-Log 500 2.8.2 - Incorrect Access Control Vulnerability

Exploit Title: Solar-Log 500 2.8.2 - Incorrect Access Control Google Dork: In Shodan search engine, the filter is ""Server: email protected"" Exploit Author: Luca.Chiou Vendor Homepage: https://www.solar-log.com/en/ Software Link: Firmware for Solar-Log...

Backdoor.Win32.Zombam.gen Buffer Overflow

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ff6516c881dee555b0cd253408b64404C.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.gen Vulnerability: Remote Stack Buffer Overflow Description: Zombam malware...

Backdoor.Win32.Zombam.gen Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ff6516c881dee555b0cd253408b64404B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.gen Vulnerability: Unauthenticated URL Command Injection Description: Zombam...

Steam Gaming Platform Hosting Malware

UPDATE Look out for SteamHide, an emerging malware that disguises itself inside profile images on the gaming platform Steam, which researchers think is being developed for a wide-scale campaign. The Steam platform merely serves as a vehicle which hosts the malicious file, according to research fr...

GHSA-RCP4-JM2V-MR3F Cross-site scripting in Shopizer

A stored cross-site scripting XSS vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customername in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when informati...