6755 matches found
Important: Red Hat Security Advisory: sudo security update
An update for sudo is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
Important: Red Hat Security Advisory: sudo security update
An update for sudo is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
Important: Red Hat Security Advisory: sudo security update
An update for sudo is now available for Red Hat Enterprise Linux 7.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
SmartAgent Security Vulnerabilities
A security vulnerability exists in SmartAgent 3.1.0 that can be exploited by an attacker to create Super Administrators via //CampaignManager/users...
Logic flaw vulnerability in phpstudy-linux panel
The phpstudy-linux panel is a server environment building as well as management tool for Linux servers. A logic flaw vulnerability exists in phpstudy-linux panel. An attacker can exploit the vulnerability to add arbitrary administrators...
Exploit for Improper Privilege Management in Microsoft
内网渗透学习笔记 作者：chriskali Github：chriskaliX 近期，拜读了腾讯蓝军-红蓝对抗之Windows内网渗透，学到了不少知识点。打算拆分章节进行整理以及复现，主要记录自己缺失的知识点。这是一个大杂烩文章，主线是跟着jumbo师傅的思路，碰到感兴趣的，我会继续扩展。可能有点凌乱，希望大家见谅。 0x01 环境搭建 这一步略过，简单介绍一下测试的环境 |主机名|IP地址|角色|系统| |:-:|:-:|:-:|:-:| |DC|10.10.10.10|DC|DNS|Winserver 2012| |John|10.10.10.11|normal|win7|...
OpenMage Magento Lts Injection Vulnerability
OpenMage Magento Lts is an e-commerce system organized by OpenMage. A security vulnerability exists in OpenMage Magento Lts before versions 19.4.10 and 20.0.5, which originates from the fact that an administrator with privileges to import and export data and edit cms pages can inject executable...
Oracle Releases January 2021 Security Bulletin
Oracle has released its Critical Patch Update for January 2021 to address 329 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Oracle January 2021...
CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on...
CVE-2020-35128
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target use...
Cross site scripting
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on...
Design/Logic Flaw
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target use...
CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on...
Juniper Networks Releases Security Updates for Multiple Products
Juniper Networks has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to cause take control of an affected system. CISA encourages users and administrators to review the Juniper Networks security advisories...
Elementor Contact Form DB < 1.6 - Plugin Settings Cross-Site Request Forgery
The plugin lacked CSRF nonces, which could allow attackers to make logged in administrators perform unwanted actions, such as change the plugin's settings via a CSRF attack...
NSA Releases Guidance on Eliminating Obsolete TLS Protocol Configurations
The National Security Agency NSA has released a Cybersecurity Information CSI sheet on eliminating obsolete Transport Layer Security TLS configurations. The information sheet identifies strategies to detect obsolete cipher suites and key exchange mechanisms, discusses recommended TLS...
phpList SQL Injection Vulnerability (CNVD-2020-75154)
phpList is an open source newsletter and email marketing software from phpList UK. A SQL injection vulnerability exists in phpList 3.5.9. The vulnerability can be exploited to inject SQL queries via the attribute on line 4 of the "Config - Import Administrators" page...
CVE-2020-35708
phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page...