Heap-based Buffer Overflow in zyantific/zydis

Description Hello, we hope you're doing well during these challenging times. Whilst testing zydis built from commit 077b185 with Clang12 + ASan on Ubuntu 18.04, we discovered a crafted PE file that when fed to ZydisPE triggers a heap-buffer-overflow, READ of size 1. Proof of Concept POC Base64...

OPENSUSE-SU-2021:1389-1 Security update for mbedtls

This update for mbedtls fixes the following issues: CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM boo1189589 Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code...

Security update for mbedtls (moderate)

openSUSE Security Update: Security update for mbedtls Announcement ID: openSUSE-SU-2021:1389-1 Rating: moderate References: 1189589 Cross-References: CVE-2021-24119 CVSS scores: CVE-2021-24119 NVD : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP3 ...

WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting Vulnerability

Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting XSS Google Dork: "inurl:avia-element-paging" Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles Vendor Homepage: https://kriesi.at/ Version: Enfold This URL must include pages show...

WordPress Enfold Theme 4.8.3 Cross Site Scripting

Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting XSS Google Dork: "inurl:avia-element-paging" Date: 18/10/2021 Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles Vendor Homepage: https://kriesi.at/ Version: Enfold This URL must...

WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS)

Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting XSS Google Dork: "inurl:avia-element-paging" Date: 18/10/2021 Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles Vendor Homepage: https://kriesi.at/ Version: Enfold This URL must...

HackTools

This is a web browser extension for penetration testing, called HackTools. It is a comprehensive toolset for web application security testing, providing various features such as: Dynamic shell generation PHP, Bash, Ruby, Python, Perl, Netcat XSS payload generation Common SQL injection payloads...

OPENSUSE-SU-2021:1355-1 Security update for mbedtls

This update for mbedtls fixes the following issues: CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM boo1189589 Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code. This update was imported from the...

Security update for mbedtls (moderate)

openSUSE Security Update: Security update for mbedtls Announcement ID: openSUSE-SU-2021:1355-1 Rating: moderate References: 1189589 Cross-References: CVE-2021-24119 CVSS scores: CVE-2021-24119 NVD : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP2 ...

CVE-2021-38346

The Brizy Page Builder plugin = 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizycreateblockscreenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory...

CVE-2021-38346

The Brizy Page Builder plugin = 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizycreateblockscreenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory...

Directory traversal

The Brizy Page Builder plugin = 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizycreateblockscreenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory...

Brizy < 2.3.12 - Authenticated File Upload and Path Traversal

Using the brizycreateblockscreenshot AJAX action, it was possible to provide a filename using the id parameter, and populate the file contents via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin appended .jpg to all uploaded filenames, a double extensio...

Moodle Admin Shell Upload Exploit

This Metasploit module will generate a plugin which can receive a malicious payload request and upload it to a server running Moodle provided valid admin credentials are used. Then the payload is sent for execution, and the plugin uninstalled. You must have an admin account to exploit this...

openSUSE: Security Advisory for mbedtls (openSUSE-SU-2021:1344-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:1344-1 Security update for mbedtls

This update for mbedtls fixes the following issues: CVE-2021-24119: Fixed side-channel vulnerability in base64 PEM boo1189589 Guard against strong local side channel attack against base64 tables by making access aceess to them use constant flow code...

Security update for mbedtls (moderate)

openSUSE Security Update: Security update for mbedtls Announcement ID: openSUSE-SU-2021:1344-1 Rating: moderate References: 1189589 Cross-References: CVE-2021-24119 CVSS scores: CVE-2021-24119 NVD : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 An update...

GHSA-CQ6W-W5RJ-P9X8 Cross-site Scripting in Froala Editor

Froala Editor 3.2.6 is affected by Cross Site Scripting XSS. Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting XSS vulnerability within the hyperlink creation module...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-22005-metasploit the metasploit scriptPOC/EXP about...

WhatsUpGold 21.0.3 Cross Site Scripting

Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting XSS Date: 09.17.2021 Exploit Author: Andreas Finstad 4ndr34z Vendor Homepage: https://www.whatsupgold.com Version: v.21.0.3, Build 188 Tested on: Windows 2019 Server CVE : CVE-2021-41318 Reference:...