4729 matches found
CVE-2021-24033
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...
Command injection
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...
CVE-2021-24033
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...
CVE-2021-24033
CVE-2021-24033 affects react-dev-utils prior to v11.0.4, where the function getProcessForPort concatenates an input argument into a shell command. The issue is only exploitable if this function is called with user-supplied input (i.e., via custom code); using it from react-scripts (as in Create R...
Textpattern CMS 4.9.0-dev - (Excerpt) Persistent Cross-Site Scripting Vulnerability
Exploit Title: Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting XSS Date: 2021-03-04 Exploit Author: Tushar Vaidya Vendor Homepage: https://textpattern.com Software Link: https://textpattern.com/start Version: v 4.9.0-dev Tested on: Windows Steps-To-Reproduce: 1. Login into...
Unibox 2.4 CSRF / Remote Code Execution
===================================================== Authenticated Remote Code Execution In Unibox 2.4 ===================================================== . contents:: Table Of Content Overview ======== Title:- Authenticated command execution in all UNIBOX WiFi Hotspot Controller. CVE ID:- Not...
'//WEB-INF/' Information Disclosure Vulnerability (HTTP)
Various application or web servers / products are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
libvirt: Unintended access to /dev/mapper/control
Background libvirt is a C toolkit for manipulating virtual machines. Description A file descriptor for /dev/mapper/control was insufficiently protected. Impact A local attacker may be able to escalate to root privileges. Workaround There is no known workaround at this time. Resolution All libvirt...
GLSA-202101-22 : libvirt: Unintended access to /dev/mapper/control
The remote host is affected by the vulnerability described in GLSA-202101-22 libvirt: Unintended access to /dev/mapper/control A file descriptor for /dev/mapper/control was insufficiently protected. Impact : A local attacker may be able to escalate to root privileges. Workaround : There is no kno...
The vulnerability of the dev_map_read function in the input/output tracing utility Blktrace allows a attacker to cause a service failure.
The vulnerability of the devmapread function in the Blktrace input/output tracing utility is related to the operation of pushing the output data beyond the allowable buffer size in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
GHSA-2CCX-2GF3-8XVV Kirby .dev domains and some reverse proxy setups were treated as local
Impact About our registration block In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget...
Kirby .dev domains and some reverse proxy setups were treated as local
Impact About our registration block In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget...
Experts Sound Alarm On New Android Malware Sold On Hacking Forums
Cybersecurity researchers have exposed the operations of an Android malware vendor who teamed up with a second threat actor to market and sell a remote access Trojan RAT capable of device takeover and exfiltration of photos, locations, contacts, and messages from popular apps such as Facebook,...
Experts Sound Alarm On New Android Malware Sold On Hacking Forums
Cybersecurity researchers have exposed the operations of an Android malware vendor who teamed up with a second threat actor to market and sell a remote access Trojan RAT capable of device takeover and exfiltration of photos, locations, contacts, and messages from popular apps such as Facebook,...
h1-ctf: [h1ctf-Grinch Networks] MrR3b00t Saving the Christmas
Disclaimer: Certain things are a bit modified to set the pieces for the story. Also you can find the flags for all 12 challenges in file F1138300 , Now enjoy : █▀▄▀█ █▀█ ░ █▀█ █▄▄ █▀█ █▀█ ▀█▀ █░▀░█ █▀▄ ▄ █▀▄ █▄█ █▄█ █▄█ ░█░ saves the Christmas Episode - 0x00 Pil0t.py It was a gloomy clear night,...
ledger-rest-api-dev (>=0.1.9 <=0.1.10) potentially affected by CVE-2020-11093 via indy-node (=1.0.28)
indy-node PYPI version =1.0.28 is affected by a known vulnerability. The following packages have a transitive dependency on indy-node and may be impacted: - ledger-rest-api-dev =0.1.9, =0.1.10 Source cves: CVE-2020-11093 Source advisory: OSV:PYSEC-2020-48...
GLSA-202012-13 : OpenSSL: Denial of service
The remote host is affected by the vulnerability described in GLSA-202012-13 OpenSSL: Denial of service A NULL pointer dereference flaw was found in OpenSSL. Impact : A remote attacker, able to control the arguments of the GENERALNAMEcmp function in an application linked against OpenSSL, could...
Ubuntu 20.10 : python-apt regression (USN-4668-2)
The remote Ubuntu 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4668-2 advisory. USN-4668-1 introduced a regression in python-apt. Tenable has extracted the preceding description block directly from the Ubuntu security advisory. Note that Nessus h...
NewStart CGSL CORE 5.04 / MAIN 5.04 : libqb Vulnerability (NS-SA-2020-0057)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libqb packages installed that are affected by a vulnerability: - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames under /dev/shm and /tmp without...