Apple Patches Two iOS Zero-Days Abused for Years

Update Researchers are reporting two Apple iOS zero-day security vulnerabilities affecting its Mail app on iPhones and iPads. Impacted are iOS 6 and iOS 13.4.1. Apple patched both vulnerabilities in iOS 13.4.5 beta, released last week. A final release of iOS 13.4.5 is expected soon. Both...

Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH)

Exploit Title: Atomic Alarm Clock 6.3 - Stack Overflow Unicode+SEH Exploit Author: Bobby Cooke Date: 2020-04-17 Vendor: Drive Software Company Vendor Site: http://www.drive-software.com Software Download: http://www.drive-software.com/download/ataclock.exe Tested On: Windows 10 - Pro 1909 x86...

Malicious Package

Overview beta-tools is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using beta-tools...

XSS Vulnerability in Extreme CMS Beta 1.6.7

Extreme CMS Beta is a php+mysql an open source CMS system. Extreme CMS Beta 1.6.7 suffers from an XSS vulnerability, which can be exploited by attackers to execute malicious code and obtain administrator cookies...

ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Product : ECK Hotel Version : 1.0-beta Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download Exploit Author: Mustafa Emre Gül...

ECK Hotel 1.0 Cross Site Request Forgery

Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Product : ECK Hotel Version : 1.0-beta Date: 2020-03-26 Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download Exploit Author: Mustafa Emre Gül Website: https://emregul.com.tr/ Tested...

Nick Chan Bot Operating System Command Injection Vulnerability

Nick Chan Bot is a private Discord bot written using the discord.js library. An operating system command injection vulnerability exists in versions prior to Nick Chan Bot 1.0.0-beta. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc...

CVE-2020-5282

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...

CVE-2020-5282

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...

Command injection

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...

Design/Logic Flaw

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...

CVE-2020-8986

CVE-2020-8986 affects ZendTo prior to 5.22-2 Beta. The issue is in lib/NSSDropbox.php where equality is not correctly checked when validating the session cookie, enabling an attacker to gain administrative access with a large number of requests. The Red Hat/NVD entries corroborate the impact and ...

CVE-2020-8985

ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality...

GHSA-G9RQ-X4FJ-F5HX Remote Code Execution Through Image Uploads in BookStack

Impact A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area o...

Knockout.js < 3.5.0-beta Cross-site Scripting

According to its self-reported version number, Knockout.js is prior to 3.5.0-beta. Therefore, it may be affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source...

Sql injection

SQL injection vulnerability in search.php in phxEventManager 2.0 beta 5 allows remote attackers to execute arbitrary SQL commands via the searchterms parameter...

CVE-2020-8123

CVE-2020-8123 affects Strapi up to v3.0.0-beta.18.3 and earlier. The vulnerability arises in the admin console where installPlugin/uninstallPlugin paths pass user input to execa after a regex check, allowing argument injection via inputs like -h, --help, -v, or --version. This can cause the serve...

CVE-2020-8123

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application...

Design/Logic Flaw

Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "it is beta-quality software and don't put too much money in it."...

CVE-2019-14863

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...