VulnCheck KEV: CVE-2020-28949

PEAR ArchiveTar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as...

Can You Secure Your Smartphone with a Proxy?

By Owais Sultan A proxy can help you bypass restrictions and access blocked websites. It can also help you stay anonymous online, which is useful if you want to avoid being tracked by governments or advertisers. This is a post from HackRead.com Read the original post: Can You Secure Your Smartpho...

WordPress Kaswara Modern WPBakery Page Builder 3.0.1 File Upload Vulnerability

WordPress Kaswara Modern WPBakery Page Builder plugin versions 3.0.1 and below suffer from an arbitrary file upload vulnerability. Description: Arbitrary File Upload/Deletion and Other Affected Plugin: Kaswara Modern WPBakery Page Builder Addons Plugin Slug: kaswara Affected Versions: = 3.0.1 CVE...

CVE-2022-2089

The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

3S-Smart Software Solutions CODESYS 资源管理错误漏洞

CODESYS is a controller development system from Germany's 3S-Smart Software Solutions A resource management error vulnerability exists in 3S-Smart Software Solutions CODESYS V3 CmpBlkDrvTcp, which can be exploited by an unauthorized attacker to prevent new TCP connections...

CVE-2022-30792

In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected...

Mozilla: Unavailable PAC file resulted in OCSP requests being blocked

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that if a PAC URL was set and the server that hosts the PAC was not reachable, OCSP requests are blocked, resulting in incorrect error pages being shown...

Mozilla: Unavailable PAC file resulted in OCSP requests being blocked

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that if a PAC URL was set and the server that hosts the PAC was not reachable, OCSP requests are blocked, resulting in incorrect error pages being shown...

Mozilla: Unavailable PAC file resulted in OCSP requests being blocked

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that if a PAC URL was set and the server that hosts the PAC was not reachable, OCSP requests are blocked, resulting in incorrect error pages being shown...

CVE-2022-34787

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to control the reason a queue item is blocked...

CVE-2022-34787

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to control the reason a queue item is blocked...

The vulnerability of the PAM auth function in the configuration management system and the remote execution of Salt operations allows a perpetrator to execute any commands they want.

The vulnerability of the PAM auth function in configuration management and remote execution of Salt operations is related to the absence of effective blocking for “locked accounts”. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Citrix Application Delivery Management 资源管理错误漏洞

Citrix Application Delivery Management ADM is an application delivery management system from Citrix. The system provides features such as centralized network and application management. A resource management error vulnerability exists in Citrix Application Delivery Management, which is caused by ...

CVE-2022-27512

Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM...

Authorization

Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions...

CVE-2021-41946

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

CVE-2021-41946

In FiberHome VDSL2 Modem HG150-UbV3.0, a stored cross-site scripting XSS vulnerability in Parental Control -- Access Time Restriction -- Username field, a user cannot delete the rule due to the XSS...

Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

GHSA-HPWM-84H5-VQR8 Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

grafana: directory traversal vulnerability

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension...