694 matches found
Verification flaw in Solid identity-token-verifier
Impact Severity Any Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed Demonstration of Proof-of-Possession DPoP token binding. This vulnerability could give total and complete access to a targeted Pod. Summary A verification flaw in th...
Seattle Lab Mail (SLMail) 5.1.0.4420 Remote Code Execution Exploit
-- coding: utf-8 -- import socket from time import sleep from os import system system"clear" print 'Shell-code-foi-informada?\r\n' print '1 sim' print '2 nao\n' quest = intinput' ' def main: system"clear" ============================ --ensira-sua-shell-code-aqui buf = "" buf +=...
IBM HTTP Server 7.0.0.0 < 7.0.0.43 / 8.0.0.0 < 8.0.0.14 / 8.5.0.0 < 8.5.5.12 / 9.0.0.0 < 9.0.0.3 Response Splitting (289001)
The version of IBM HTTP Server running on the remote host is affected by a vulnerability related to Apache HTTP Server. Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these...
Victor CMS 1.0 SQL Injection
Exploit Title: Victor CMS 1.0 - Multiple SQL Injection Authenticated Date: 17.12.2020 Exploit Author: Furkan Göksel Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Description: The Victor CMS v1.0...
NICER Protocol Deep Dive: Internet Exposure of Redis
Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...
CVE-2020-26243
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being...
2-Factor Authentication Bypass Flaw Reported in cPanel and WHM Software
cPanel, a provider of popular administrative tools to manage web hosting, has patched a security vulnerability that could have allowed remote attackers with access to valid credentials to bypass two-factor authentication 2FA protection on an account. The issue, tracked as "SEC-575" and discovered...
Cybersecurity Awareness Checklist
Cybersecurity Awareness Month CAM 2020,, in its 17th year, is an annual campaign in October that raises awareness on the importance of cybersecurity. This year’s theme is “Do Your Part. BeCyberSmart” along with the key message “If you connect it, protect it.” 2020 has been an unprecedented year...
nj6b40.listingdetails.com Cross Site Scripting vulnerability OBB-1416272
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Malicious Package in commandre
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...
cross-env.js is malware
The cross-env.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security...
Nodesass is malware
The nodesass package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concer...
GHSA-XFMW-2VMM-579C Nodesass is malware
The nodesass package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concer...
GHSA-8GV6-G7VP-HR34 mysqljs is malware
The mysqljs package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concern...
mysqljs is malware
The mysqljs package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concern...
US firm accused of secretly installing location tracking SDK in mobile apps
By Zara Khan AUS government contractor 'Anomaly Six' has location tracking software hidden in more than 500 mobile apps. This is a post from HackRead.com Read the original post: US firm accused of secretly installing location tracking SDK in mobile apps...
Collecting and Selling Mobile Phone Location Data
The Wall Street Journal has an article about a company called Anomaly Six LLC that has an SDK that's used by "more than 500 mobile applications." Through that SDK, the company collects location data from users, which it then sells. Anomaly Six is a federal contractor that provides...
Security Update for Microsoft Visual Studio Code Maven Extension (August 2020)
An input-validation flaw exists in Visual Studio Code Maven Extension related to processing environment variables after opening a project that allows remote code execution. An attacker can convince a user to clone a specified repository and to open it in Visual Studio Code leading to code...
Ability to change order address without triggering address validations in solidus
Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zo...
Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student) Vulnerability
Exploit for php platform in category web applications Exploit Title: Online Student Enrollment System 1.0 - Cross-Site Request Forgery Add Student Exploit Author: BKpatron Vendor Homepage: https://www.campcodes.com/projects/php/4745/online-student-enrollment-system-in-php-mysqli/ Software Link:...