CVE-2021-26306

An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within asstring methods...

Dutch Insider Attack on COVID-19 Data

Insider data theft: Dutch police have arrested two individuals on Friday for allegedly selling data from the Dutch health ministrys COVID-19 systems on the criminal underground. … According to Verlaan, the two suspects worked in DDG call centers, where they had access to official Dutch government...

(0Day) Microsoft Windows PowerShell Shell Handler Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the shell handle...

Design/Logic Flaw

DISPUTED bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory e.g., outside the /.bitcoin directory via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has...

Spoofing

An issue was discovered in the abistable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness...

Shopify: [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only

Summary: PLUS User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only Description: User with Store management permission as shown in below screenshot F1168574 Should not have the ability to enforce SAML organization...

CVE-2021-3195

bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory e.g., outside the /.bitcoin directory via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented...

VulnCheck KEV: CVE-2018-8514

An information disclosure vulnerability exists when Remote Procedure Call runtime improperly initializes objects in memory, aka "Remote Procedure Call runtime Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server...

The vulnerability of the execution environment for remote process calls in the Windows operating system allows a perpetrator to execute arbitrary code.

The vulnerability of the execution environment for remote procedure calls in the Windows operating system exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2021-19612

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions through 0.21.0 Description: The issue allows bitcoind to create a new file in an arbitrary directory, such as outside the /.bitcoin directory, via a "dumpwallet" RPC call. This reportedly does not violate the security...

The vulnerability of the splwow64.exe process in the Windows operating system, which allows a hacker to escalate their privileges

The vulnerability of the splwow64.exe process in Windows operating systems is related to call processing errors. Exploiting this vulnerability can allow attackers to gain increased privileges...

Command injection

A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit this vulnerability by providing craft...

CVE-2021-1264 Cisco DNA Center Command Runner Command Injection Vulnerability

A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit this vulnerability by providing craft...

Cisco DNA Center Command Runner Command Injection Vulnerability

A vulnerability in the Command Runner tool of Cisco DNA Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation by the Command Runner tool. An attacker could exploit this vulnerability by providing craft...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Advantech Webaccess

This is a proof-of-concept PoC exploit for a vulnerability in the bwconn.dll library, which is a Windows RPC client library. The vulnerability is identified as CVE-2016-0856. The PoC exploit is written in Python and uses the ctypes library to interact with the bwconn.dll library. The exploit...

EulerOS 2.0 SP3 : util-linux (EulerOS-SA-2021-1128)

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the...

Linux/x86 - Socat Bind Shellcode (113 bytes)

/ Exploit Title: Linux/x86 - Socat Bind Shellcode 113 bytes Author: Felipe Winsnes Tested on: Debian x86 Shellcode Length: 113 global start section .text start: xor eax, eax push eax PUSH 0x30303030 ; "tcp-listen:10000" PUSH 0x313a6e65 PUSH 0x7473696c PUSH 0x2d706374 mov esi, esp push eax PUSH...

PT-2023-12547 · Odoo +1 · Odoo Community +2

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 13.0 and earlier Odoo Enterprise versions 13.0 and earlier Description: The issue allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the...

Cisco Finesse Cross-Site Scripting Vulnerability (NVD-C-2021-11018)

Cisco Finesse is a set of call center management software from the U.S. company Cisco Cisco. Cisco Finesse suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client data in the WEB application, which can be exploited by an attacker to execute client...

Microsoft Patch Tuesday, January 2021 Edition

Microsoft today released updates to plug more than 80 security holes in its Windows operating systems and other software, including one that is actively being exploited and another which was disclosed prior to today. Ten of the flaws earned Microsofts most-dire "critical" rating, meaning they cou...