2484 matches found
EulerOS 2.0 SP2 : perl (EulerOS-SA-2021-1342)
According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in...
EulerOS 2.0 SP5 : perl (EulerOS-SA-2021-1222)
According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in...
Criminal, Domestic Violence Case Info Exposed in Cook County Leak
A non-password protected database, belonging to a county in Illinois, exposed 323,000 court records for at least four months, according to researchers. The database exposed the names of various people involved in sensitive criminal, domestic-abuse or child-custody court cases. Researchers from...
EulerOS 2.0 SP3 : gnome-keyring (EulerOS-SA-2021-1071)
According to the version of the gnome-keyring packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM...
360 Kids Desktop (Windows client) suffers from dll hijacking vulnerability
360 Kids Desktop is the children's version of 360 Safe Desktop, which is a safe Internet assistance software launched by Qihoo 360 specifically for kids. 360 Kids Desktop Windows client has a dll hijacking vulnerability. An attacker can exploit this vulnerability to execute malicious code...
Bomb Threat, DDoS Purveyor Gets Eight Years
A 22-year-old North Carolina man has been sentenced to nearly eight years in prison for conducting bomb threats against thousands of schools in the U.S. and United Kingdom, running a service that launched distributed denial-of-service DDoS attacks, and for possessing sexually explicit images of...
WordPress orbisius-child-theme-creator plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. orbisius-child-theme-creator is a child theme builder plugin used in it. A cross-site request forgery vulnerability exists in versions...
CVE-2020-28649
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisiusctcthemeeditormanagefile...
CVE-2020-28649
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisiusctcthemeeditormanagefile...
Cross site request forgery (csrf)
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisiusctcthemeeditormanagefile...
CVE-2020-28649
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisiusctcthemeeditormanagefile...
Op protected childhood: 113 online child predators arrested
By Waqas The arrests took place as part of Operation protected childhood initiated by ICE, HSI, MJSP against child sexual abuse material CSAM. This is a post from HackRead.com Read the original post: Op protected childhood: 113 online child predators arrested...
WordPress Child Theme Creator by Orbisius plugin <= 1.5.1 - Cross-Site Request Forgery (CSRF) to Arbitrary File Modification/Creation vulnerability
Cross-Site Request Forgery CSRF to Arbitrary File Modification/Creation vulnerability found by Chloe Chamberland in WordPress Child Theme Creator by Orbisius plugin versions = 1.5.1. Solution Update the WordPress Child Theme Creator by Orbisius plugin to the latest available version at least 1.5....
Joplin 1.0.245 - Arbitrary Code Execution (PoC)
Exploit Title: Joplin 1.0.245 - Arbitrary Code Execution PoC Date: 2020-09-21 Exploit Author: Ademar Nowasky Junior @nowaskyjr Vendor Homepage: https://joplinapp.org/ Software Link: https://github.com/laurent22/joplin/releases/download/v1.0.245/Joplin-Setup-1.0.245.exe Version: 1.0.190 to 1.0.245...
Microsoft Bing server exposed user search queries and location data
By Waqas Microsoft Bing server logged some horrific search terms including searchers for murder and child abuse content. This is a post from HackRead.com Read the original post: Microsoft Bing server exposed user search queries and location data...
alpine-child-care.co.uk Cross Site Scripting vulnerability OBB-1354516
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Remote Code Execution in mongodb-query-parser
Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file: 'function return clearImmediate.constructor"return...
CVE-2020-25119
The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual...
Command Injection in pidusage
Affected versions of pidusage pass unsanitized input to childprocess.exec, resulting in arbitrary code execution in the ps method. This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable. Proof of Concept var pid = require'pidusage';...
Design/Logic Flaw
The modprobe child process in the ./debian/patches/loadpppgenericifneeded patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBEOPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2,...