antwerpconventionbureau.be Cross Site Scripting vulnerability OBB-3294945

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

convention-rhein-neckar.de Cross Site Scripting vulnerability OBB-3245218

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

newyorkconvention1958.org Cross Site Scripting vulnerability OBB-3177422

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

newyorkconvention.org Cross Site Scripting vulnerability OBB-3127663

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-5829 · Aveva · Aveva Edge

Name of the Vulnerable Software and Affected Versions: AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior Description: The issue is related to a path traversal vulnerability that allows an unauthenticated user to steal the Windows access token of the user account configured for...

GSD-2022-1006905 dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg

dmaengine: qcom-adm: fix wrong calling convention for prepslavesg This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-35160 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the dmaengine: qcom-adm, where a wrong calling convention for prep slave sg was identified. The actual impact and attack plausibility have not yet been proven...

Windows shellcode stage, Reverse TCP Stager with UUID Support

Custom shellcode stage. Connect back to the attacker with UUID Support Module Options msf use payload/windows/custom/reversetcpuuid msf payloadreversetcpuuid show actions ...actions... msf payloadreversetcpuuid set ACTION msf payloadreversetcpuuid show options ...show and set options... msf...

wisconsincomicconvention.com Cross Site Scripting vulnerability OBB-2762919

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-24581

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software...

com.github.kaitoy.sneo:giane (>=1.2.0 <=1.2.3), com.googlecode.struts2-conversation:struts2-conversation-scope-plugin (=1.3.1) +13 more potentially affected by CVE-2016-6795 via org.apache.struts:struts2-convention-plugin (>=2.3.1 <=2.3.30)

org.apache.struts:struts2-convention-plugin MAVEN version =2.3.1, =1.2.0, =1.1.0, =3.3.0, =3.3.0, =2.3.1, =2.3.1, =2.3.1, =2.3.1, =3.0.0, =4.0.0, =1.0, =1.2.2, =1.3.5 Source cves: CVE-2016-6795 Source advisory: OSV:GHSA-44HV-JJX7-QFJG...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=2.5.1 <=4.0.1), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (=4.0.3) +11 more potentially affected by CVE-2016-6795 via org.apache.struts:struts2-convention-plugin (>=2.5.1 <=2.5.33)

org.apache.struts:struts2-convention-plugin MAVEN version =2.5.1, =2.5.1, =1.0.0, =1.0.0, =1.0.0, =8.5.5-8.5.5-20220801, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.33 Source cves: CVE-2016-6795 Source advisory: OSV:GHSA-44HV-JJX7-QFJG...

GHSA-44HV-JJX7-QFJG Path Traversal in Apache Struts

In Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side. This vulnerability is only exploitable when using the Struts 2 Convention plugin in conjunction with Apache...

Reflecting on Women’s History Month at Rapid7

During Women’s History Month, we invited some of our team members to share their best advice for other women in technology, celebrate their strengths, and reflect on how they’ve challenged convention within their roles and built their networks. What is the best advice that someone has given you i...

CVE-2021-36123

An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on...

CVE-2021-36123

An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on...

CVE-2021-36123

An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on...

PT-2021-14537 · Sap · Sap Netweaver Master Data Management

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Master Data Management versions 7.10, 710, and 710.750 Description: The issue arises when security guidelines for SAP NetWeaver Master Data Management running on Windows have not been thoroughly reviewed. This oversight might...

[SECURITY] Fedora 33 Update: rubygem-rails-6.0.3.3-1.fc33

Ruby on Rails is a full-stack web framework optimized for programmer happin ess and sustainable productivity. It encourages beautiful code by favoring convention over configuration...

Fedora: Security Advisory for rubygem-rails (FEDORA-2020-4dd34860a3)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...