SAS Environment Manager 2.5 - (name) Stored Cross-Site Scripting Vulnerability

Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting XSS Exploit Author: Luqman Hakim Zahari @ Saitamang Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html Version: 2.5 Tested on: CentOS 7 CVE : CVE-2021-35475 Description SAS®...

The vulnerability of the CentOS Web Panel application management application lies in its lack of protection for website structure elements, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the CentOS Web Panel administration application is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Wormable DarkRadiation Ransomware Targets Linux and Docker Instances

Cybersecurity researchers are sounding the alarm bell over a new ransomware strain called "DarkRadiation" that's implemented entirely in Bash and targets Linux and Docker cloud containers, while banking on messaging service Telegram for command-and-control C2 communications. "The ransomware is...

CentOS Web Panel SQL Injection (CVE-2021-31316; CVE-2021-31324)

An SQL injection vulnerability exists in CentOS Web Panel. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Unified Office Total Connect Now 1.0 - (data) SQL Injection Vulnerability

Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection Shodan Filter: http.title:"TCN User Dashboard" Exploit Author: Ajaikumar Nadar Vendor Homepage: https://unifiedoffice.com/ Software Link: https://unifiedoffice.com/voip-business-solutions/ Version: 1.0 Tested on: CentOS +...

Unified Office Total Connect Now 1.0 SQL Injection

Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection Shodan Filter: http.title:"TCN User Dashboard" Date: 06-16-2021 Exploit Author: Ajaikumar Nadar Vendor Homepage: https://unifiedoffice.com/ Software Link: https://unifiedoffice.com/voip-business-solutions/ Version: 1.0...

CentOS 8 : nginx:1.18 (CESA-2021:2259)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2259 advisory. - nginx: Off-by-one in ngxresolvercopy when labels are followed by a pointer to a root domain name CVE-2021-23017 Note that Nessus has not tested for this issue...

CentOS 8 : container-tools:2.0 (CESA-2021:2291)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2291 advisory. - runc: vulnerable to symlink exchange attack CVE-2021-30465 Note that Nessus has not tested for this issue but has instead relied only on the application's...

CentOS 8 : postgresql:12 (CESA-2021:2372)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2372 advisory. - postgresql: Buffer overrun from integer overflow in array subscripting calculations CVE-2021-32027 - postgresql: Memory disclosure in INSERT ... ON...

CentOS 8 : postgresql:13 (CESA-2021:2375)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2375 advisory. - postgresql: Buffer overrun from integer overflow in array subscripting calculations CVE-2021-32027 - postgresql: Memory disclosure in INSERT ... ON...

CentOS 8 : postgresql:9.6 (CESA-2021:2360)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2360 advisory. - postgresql: Buffer overrun from integer overflow in array subscripting calculations CVE-2021-32027 - postgresql: Memory disclosure in INSERT ... ON...

CentOS 8 : libwebp (CESA-2021:2354)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2354 advisory. - libwebp: heap-based buffer overflow in PutLE16 CVE-2018-25011 - libwebp: heap-based buffer overflow in WebPDecodeInto functions CVE-2020-36328 -...

CentOS 8 : container-tools:3.0 (CESA-2021:2370)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2370 advisory. - runc: vulnerable to symlink exchange attack CVE-2021-30465 Note that Nessus has not tested for this issue but has instead relied only on the application's...

CentOS 8 : postgresql:10 (CESA-2021:2361)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2361 advisory. - postgresql: Buffer overrun from integer overflow in array subscripting calculations CVE-2021-32027 - postgresql: Memory disclosure in INSERT ... ON...

CentOS 8 : nginx:1.16 (CESA-2021:2290)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2290 advisory. - nginx: Off-by-one in ngxresolvercopy when labels are followed by a pointer to a root domain name CVE-2021-23017 Note that Nessus has not tested for this issue...

CentOS 8 : container-tools:rhel8 (CESA-2021:2371)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2371 advisory. - runc: vulnerable to symlink exchange attack CVE-2021-30465 Note that Nessus has not tested for this issue but has instead relied only on the application's...

CentOS 8 : microcode_ctl (CESA-2021:2308)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:2308 advisory. - hw: vt-d related privilege escalation CVE-2020-24489 - hw: improper isolation of shared resources in some Intel Processors CVE-2020-24511 - hw:...

CentOS 8 : gupnp (CESA-2021:2363)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2363 advisory. - gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services CVE-2021-33516 Note that Nessus has not...

CentOS 8 : thunderbird (CESA-2021:2264)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:2264 advisory. - Mozilla: Thunderbird stored OpenPGP secret keys without master password protection CVE-2021-29956 - Mozilla: Partial protection of inline OpenPGP...

CentOS: Security Advisory for hivex (CESA-2021:2318)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...