CVE-2020-13784

CVE-2020-13784 concerns the D-Link DIR-865L Ax router with firmware 1.20B01 Beta, where the pseudo-random number generator uses a predictable seed. The connected CNVD entry confirms a security feature issue vulnerability for the same device/firmware, citing the easily guessable PRNG seed as the u...

CVE-2020-13785

D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength...

Langfang Extreme Networks Technology Co., Ltd Extreme CMS beta version suffers from arbitrary file download vulnerability

Extreme CMS is open source and free PHPCMS web content management system. Ltd Extreme CMS beta version suffers from an arbitrary file download vulnerability, which can be exploited by attackers to compromise confidentiality...

iOS XML Bug

This is a good explanation of an iOS bug that allowed someone to break out of the application sandbox. A summary: What a crazy bug, and Siguza's explanation is very cogent. Basically, it comes down to this: XML is terrible. iOS uses XML for Plists, and Plists are used everywhere in iOS and MacOS...

MPC Sharj 3.11.1 - Arbitrary File Download Exploit

Exploit for php platform in category web applications Exploit title : MPC Sharj 3.11.1 - Arbitrary File Download Exploit Author : SajjadBnd Date : 2020-05-02 Software Link : http://dl.nuller.ir/mpc-sharj-vr3.11.1betawww.nuller.ir.zip Tested on : Ubuntu 19.10 Version : 3.11.1 Beta DESCRIPTION MPC...

Hyperledger Iroha has a flawed logic vulnerability

Hyperledger Iroha is a distributed system for asset creation and management based on blockchain technology. A security vulnerability exists in Hyperledger Iroha versions 1.0beta and 1.0.0beta-1. An attacker can exploit the vulnerability by sending a specially crafted request to bypass signature...

[SECURITY] Fedora 30 Update: pxz-4.999.9-19.beta.20200421git.fc30

Parallel XZ is a compression utility that takes advantage of running XZ compression simultaneously on different parts of an input file on multiple cores and processors. This significantly speeds up compression time...

[SECURITY] Fedora 32 Update: pxz-4.999.9-19.beta.20200421git.fc32

Parallel XZ is a compression utility that takes advantage of running XZ compression simultaneously on different parts of an input file on multiple cores and processors. This significantly speeds up compression tim e...

XSS vulnerability in WeiPHP 5.0 beta frontend Ga***.php at Shenzhen Yuanmeng Cloud Technology Co.

WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. An XSS vulnerability exists in the frontend Ga.php of WeiPHP 5.0 beta version by Shenzhen Yuanmeng Yun Technology Co. Attackers can use this vulnerability to insert...

Apple Patches Two iOS Zero-Days Abused for Years

Update Researchers are reporting two Apple iOS zero-day security vulnerabilities affecting its Mail app on iPhones and iPads. Impacted are iOS 6 and iOS 13.4.1. Apple patched both vulnerabilities in iOS 13.4.5 beta, released last week. A final release of iOS 13.4.5 is expected soon. Both...

Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH)

Exploit Title: Atomic Alarm Clock 6.3 - Stack Overflow Unicode+SEH Exploit Author: Bobby Cooke Date: 2020-04-17 Vendor: Drive Software Company Vendor Site: http://www.drive-software.com Software Download: http://www.drive-software.com/download/ataclock.exe Tested On: Windows 10 - Pro 1909 x86...

Malicious Package

Overview beta-tools is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using beta-tools...

XSS Vulnerability in Extreme CMS Beta 1.6.7

Extreme CMS Beta is a php+mysql an open source CMS system. Extreme CMS Beta 1.6.7 suffers from an XSS vulnerability, which can be exploited by attackers to execute malicious code and obtain administrator cookies...

ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Product : ECK Hotel Version : 1.0-beta Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download Exploit Author: Mustafa Emre Gül...

ECK Hotel 1.0 Cross Site Request Forgery

Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Product : ECK Hotel Version : 1.0-beta Date: 2020-03-26 Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download Exploit Author: Mustafa Emre Gül Website: https://emregul.com.tr/ Tested...

Nick Chan Bot Operating System Command Injection Vulnerability

Nick Chan Bot is a private Discord bot written using the discord.js library. An operating system command injection vulnerability exists in versions prior to Nick Chan Bot 1.0.0-beta. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc...

CVE-2020-5282

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...

Command injection

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...

Design/Logic Flaw

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...

CVE-2020-8986

CVE-2020-8986 affects ZendTo prior to 5.22-2 Beta. The issue is in lib/NSSDropbox.php where equality is not correctly checked when validating the session cookie, enabling an attacker to gain administrative access with a large number of requests. The Red Hat/NVD entries corroborate the impact and ...