Security Bulletin: A vulnerability in SQLite affects IBM Cloud Application Performance Management Response Time Monitoring Agent (CVE-2019-19925, CVE-2019-19645, CVE-2019-19924, CVE-2019-19923, CVE-2019-19880, CVE-2019-19646, CVE-2019-19926)

Summary SQLite is vulnerable to a denial of service. Vulnerability Details CVEID: CVE-2019-19925 DESCRIPTION: SQLite is vulnerable to a denial of service, caused by the mishandling of a NULL pathname in the zipfileUpdate function in ext/misc/zipfile.c. By sending a specially-crafted request, a...

ZSQL: Check for users with CREATE DATABASE permission

Searches for users and roles with CREATE DATABASE permission and checks whether they are authorized to have it. A user with the CREATE DATABASE permission can creata a database. If this permission is no longer necessary, revoke it. Copyright C 2020 Greenbone Networks GmbH Some text descriptions...

Moderate: Red Hat Security Advisory: openstack-manila security update

An update for openstack-manila is now available for Red Hat OpenStack Platform 15 Stein. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

The vulnerability of the atalk_create function in the net/appletalk/ddp.c module of the AF_APPLETALK module, within the Linux operating system’s kernel, relates to default access rights settings. This vulnerability allows an attacker to compromise data integrity.

The vulnerability of the atalkcreate function in the net/appletalk/ddp.c module of the AFAPPLETALK module is related to the lack of a standard permission mechanism. Exploiting this vulnerability could allow an attacker to compromise data integrity...

The vulnerability of the base_sock_create function in the drivers/isdn/mISDN/socket.c module of the AF_ISDN module in the Linux operating system arises from insufficient input validation. This vulnerability allows an attacker to compromise data integrity.

The vulnerability of the basesockcreate function in the drivers/isdn/mISDN/socket.c module of the AFISDN module in the Linux kernel is related to a lack of mechanisms for checking input data. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

CVE-2018-16850

A SQL Injection flaw has been discovered in PostgreSQL server in the way triggers that enable transition relations are dumped. The transition relation name is not correctly quoted and it may allow an attacker with CREATE privilege on some non-temporary schema or TRIGGER privilege on some table to...

Slack: Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack users

An issue in Slack's Create snippet feature results in filetypes being displayed incorrectly. This can lead to RCE if a Slack user downloads an executable file thinking that it is a CSV or other benign file type. https://www.youtube.com/watch?v=cIlGfnn4iG8...

ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)

ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Product : ECK Hotel Version : 1.0-beta Date: 2020-03-26 Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download Exploit Author:...

The vulnerability of the Windows Media Foundation component in Windows operating systems allows attackers to install programs, view, modify, delete data, or create new accounts with full user privileges.

The vulnerability of the Windows Media Foundation component in Windows operating systems arises from incorrect handling of objects in memory. Exploiting this vulnerability allows attackers to install programs, view, modify, delete data, or create new user accounts with full privileges using a...

WordPress pricing-table-by-supsystic insecure permissions vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security issue exists in WordPress pricing-table-by-supsystic prior to version 1.8.2, which stems from the...

Rconfig 3.x Chained Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rconfig 3.x Chained Remote Code Execution', 'Description' = ' This module exploits multiple vulnerabilities in rConfig version 3.9 in order to...

Cross site request forgery (csrf)

CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request...

WordPress MStore API plugin <= 2.1.5 - Unauthenticated Account Create/Edit vulnerability

Unauthenticated Account Create/Edit vulnerability discovered by NinTechNet in WordPress MStore API plugin versions = 2.1.5. Solution Update the WordPress MStore API plugin to the latest available version at least 2.1.6...

Arbitrary Code Execution

Overview pixl-class is a library that allows you to create classes in a more classical sort of way, including support for static class members, proper constructors, inheritance, and mixins. Affected versions of this package are vulnerable to Arbitrary Code Execution. The injection point is locate...

CVE-2020-8635

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files...

Design/Logic Flaw

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files...

CVE-2020-3148

A vulnerability in the web-based interface of Cisco Prime Network Registrar CPNR could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account via a request to mods/core/users/admins/create.php or 2 create a user account via a request to...

CVE-2015-1583

Multiple cross-site request forgery CSRF vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account via a request to mods/core/users/admins/create.php or 2 create a user account via a request to...

Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin) Exploit

Exploit for php platform in category web applications Exploit Title: Business Live Chat Software 1.0 - Cross-Site Request Forgery Add Admin Description: Operator Can Change Role User Type to admin Exploit Author: Meisam Monsef Vendor Homepage: https://www.bdtask.com/business-live-chat-software.ph...