kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c

A flaw was found in the AMD Cryptographic Co-processor driver in the Linux kernel. An attacker, able to send invalid SHA type commands, could cause the system to crash. The highest threat from this vulnerability is to system availability...

SQL Injection Vulnerability in Gal***-co***.php Page of Website Building System of Qingdao Shangzhixin Network Technology Co.

Qingdao Business to letter network technology limited company is a professional engaged in e-commerce, network marketing, software development, IDC and related network value-added services of high-tech specialized companies. There is a SQL injection vulnerability in gal-co.php, which can be...

Beijing Haiteng Times Technology Co. Extreme OFFICE 2019 has a memory corruption vulnerability

Extreme OFFICE 2019 is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. There is a memory corruption vulnerability in Extreme OFFICE 2019 by Beijing Haiteng Times Technology Co. that can be exploited by attackers to cause a denial of service...

SQL Injection Vulnerability in XSLCMS co***.php Page

New Force Content Management System XSLCMS is a set of web content management system specialized for enterprise website construction. A SQL injection vulnerability exists in the XSLCMS co.php page. An attacker can exploit the vulnerability to obtain sensitive database information...

Snake Ransomware Delivers Double-Strike on Honda, Energy Co.

The Snake ransomware has reportedly hit two high-profile companies this week: Honda and a South American energy-distribution company called Enel Argentina. In a tweet on Monday, the Honda Automobile Customer Service said it was “experiencing technical difficulties and are unavailable.” And later,...

au.work180.co Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1186586 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Cayin Signage Media Player 3.0 Root Remote Command Injection

!/usr/bin/env python3 Cayin Signage Media Player 3.0 Root Remote Command Injection Vendor: CAYIN Technology Co., Ltd. Product web page: https://www.cayintech.com Affected version: SMP-8000QD v3.0 SMP-8000 v3.0 SMP-6000 v3.0 Build 19025 SMP-6000 v1.0 Build 14246 SMP-6000 v1.0 Build 14199 SMP-6000...

Cayin Digital Signage System xPost 2.5 - Remote Command Injection Exploit

Exploit for multiple platform in category web applications Title: Cayin Digital Signage System xPost 2.5 - Remote Command Injection Author:LiquidWorm Vendor: https://www.cayintech.com CVE: N/A !/usr/bin/env python3 Cayin Digital Signage System xPost 2.5 Pre-Auth SQLi Remote Code Execution Vendor:...

Reverse Engineering a 5g ‘Bioshield’

Six months ago the UK's Glastonbury Town Council set up a 5g Advisory Committee to explore the safety of the technology, and last month the local paper reported their findings. This statement is in their recommended measures report page 31 of this PDF: 5G Bioshield https://5gbioshield.com/ We use...

EyouCMS 1.4.6 Cross Site Scripting

Exploit Title: EyouCMS 1.4.6 - Persistent Cross-Site Scripting Date: 2020-05-28 Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd. Vendor Homepage: https://eyoucms.com Software Link: https://qiniu.eyoucms.com/EyouCMS-V1.4.6-UTF8-SP2.zip Version: EyouCMS V1.4.6...

Brazil’s cosmetic giant Natura leaked 192 million records with payment data

By Waqas It's a massive security failure by The Natura & Co Group. This is a post from HackRead.com Read the original post: Brazil's cosmetic giant Natura leaked 192 million records with payment data...

SQL injection vulnerability in the co***.php page of the website building system of Hubei Guosheng Technology Co.

Ltd. is a full-network value marketing service provider, to provide customers with comprehensive digital innovation services, to help traditional enterprises to realize the "Internet +" transformation and upgrading. There is a SQL injection vulnerability in the co.php page of the website building...

SQL injection vulnerability in the co*** parameter of the ordasoft-cck component of Joomla!

Developed with PHP language and MySQL database, Joomla! is a content management system. A SQL injection vulnerability exists in the co parameter of the Joomla! ordasoft-cck component. An attacker can exploit this vulnerability to obtain sensitive database information...

CVE-2020-7803

IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution...

Arbitrary file deletion

IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution...

CVE-2020-7803 Zoneplayer ActiveX File Download Vulnerability

IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution...

CVE-2019-19165

AxECM.cabActiveX Control in Inogard Ebiz4u contains a vulnerability that could allow remote files to be downloaded and executed by setting arguments to the activeX method. Download of Code Without Integrity Check vulnerability in ActiveX control of Inogard Co,,LTD Ebiz4u ActiveX of Inogard...

JVN#47668991: Sales Force Assistant vulnerable to cross-site scripting

Sales Force Assistant provided by NI Consulting CO.,Ltd. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser while logging in Sales Force Assistant. Solution Update the Software Update the software to the latest version...

Furukawa Electric ConsciusMAP 2.8.1 Java Deserialization Remote Code Execution

!/usr/bin/env python3 -- coding: utf-8 -- Furukawa Electric ConsciusMAP 2.8.1 Java Deserialization Remote Code Execution Vendor: Furukawa Electric Co., Ltd. | Tecnored SA Product web page: https://www.furukawa.co.jp | https://www.tecnoredsa.com.ar Affected version: APROS Evolution | 2.8.1 FURUKAW...

Oil and Gas Firms Targeted With Agent Tesla Spyware

Attackers are targeting energy companies with the Agent Tesla spyware, as seen in recent spearphishing emails with malicious attachments. Researchers say that until now, Agent Tesla has not been associated with campaigns targeting the oil-and-gas vertical. The emails leverage the tumultuous natur...