The vulnerability of the web protection component of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, and Kaspersky Security Cloud allows a malicious actor to disable certain security functions of the product, such as private browsing and antivirus protection.

The vulnerability of the web protection component of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, and Kaspersky Security Cloud lies in insufficient validation of input data. Exploiting this vulnerability c...

PT-2020-7359

Name of the Vulnerable Software and Affected Versions: D-Link IP Cameras DCS-3411/3430 version 1.02 D-Link IP Cameras DCS-5605/5635 version 1.01 D-Link IP Cameras DCS-1100L/1130L version 1.04 D-Link IP Cameras DCS-1100/1130 version 1.03 D-Link IP Cameras DCS-1100/1130 version 1.04 US D-Link IP...

CVE-2019-19894

In IXP EasyInstall 6.2.13723, the vulnerability allows a local attacker to disable User Account Control (UAC) on a client system by abusing the Agent Service and renaming/replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP. An authenticated attacker (non-admin) can disable UAC for other users, which may i...

CVE-2019-19894

In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker non-admin can disable UAC for other users by renaming and replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP...

PT-2020-9881 · Fasttrack · Fasttrack Admin By Request

Name of the Vulnerable Software and Affected Versions: FastTrack Admin By Request version 6.1.0.0 Description: The issue concerns the elevation of privileges to Administrator level. Normally, group policies restrict this ability to a select range of users. However, when a user without direct acce...

PT-2020-19480 · Simplejobscript.Com · Sjs

Name of the Vulnerable Software and Affected Versions: Simplejobscript.com SJS versions prior to 1.65 Description: An issue was discovered in Simplejobscript.com SJS. There is unauthenticated SQL injection via the search engine, specifically through the landing location parameter in the...

PT-2020-15302 · Jenkins · Jenkins Gitlab Hook Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gitlab Hook Plugin versions 1.4.2 and earlier Description: The issue is related to a reflected XSS vulnerability. It occurs because project names in the "build now" endpoint are not properly escaped, allowing for potential exploitatio...

Junos OS vulnerable to cross-site scripting

Overview Junos OS contains a cross-site scripting vulnerability CWE-79. Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be...

PT-2020-5164 · Pysaml2 +2 · Pysaml2 +2

Name of the Vulnerable Software and Affected Versions: PySAML2 versions prior to 5.0.0 Description: The issue is related to incorrect verification of cryptographic signatures in SAML2 documents, allowing a remote attacker to bypass signature checks and access protected information. This is due to...

openSUSE: Security Advisory for LibreOffice (openSUSE-SU-2019:2709-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Minimal Coming Soon & Maintenance Mode < 2.15 - Insecure Permissions: Enable and Disable Maintenance Mode

There was a flaw that allowed any authenticated user with subscriber permissions or above the ability to enable and disable maintenance mode on a vulnerable site by sending a simple request. PoC Login as a user with subscriber or above permissions and send the following request to enable...

PT-2020-18488 · Phpgurukul · Phpgurukul Small Crm

Name of the Vulnerable Software and Affected Versions: PHPGurukul Small CRM version 2.0 Description: The issue concerns an authentication bypass via SQL injection when logging into the administrator login page. This allows unauthorized access, potentially leading to further malicious activities...

Minimal Coming Soon & Maintenance Mode < 2.15 - Insecure Permissions: Enable and Disable Maintenance Mode

There was a flaw that allowed any authenticated user with subscriber permissions or above the ability to enable and disable maintenance mode on a vulnerable site by sending a simple request. Login as a user with subscriber or above permissions and send the following request to enable maintenance...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - Insecure Permissions: Enable and Disable Maintenance Mode vulnerability

Insecure Permissions: Enable and Disable Maintenance Mode vulnerability discovered by WordFence in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...

Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)

Title: Linux/x86 - Execve Alphanumeric Shellcode 66 bytes Shellcode Author: bolonobolo Tested on: Linux x86 execve.asm global start section .text start: ; int 0x80 ------------ push 0x30 pop eax xor al, 0x30 push eax pop edx dec eax xor ax, 0x4f73 xor ax, 0x3041 push eax push edx pop eax...

PT-2020-18478 · Fontforge +3 · Fontforge +3

Name of the Vulnerable Software and Affected Versions: FontForge version 20190801 Description: The issue is a heap-based buffer overflow in the Type2NotDefSplines function in splinesave.c. This occurs due to improper handling of data, leading to a potential overflow. Recommendations: For FontForg...

PT-2019-16071 · Symfony +1 · Symfony Webprofiler +1

Name of the Vulnerable Software and Affected Versions: Bolt version 3.7.0 Description: The issue allows for XSS because unsanitized search input is shown on the profiler page when Symfony Web Profiler is used. It is noted that this issue is disputed as profiling was never intended for use in...

AVE DOMINAplus 1.10.x Cross Site Request Forgery / Cross Site Scripting

AVE DOMINAplus =1.10.x CSRF/XSS Vulnerabilities Vendor: AVE S.p.A. Product web page: https://www.ave.it | https://www.domoticaplus.it Affected version: Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V | TS04X-V - 1.10.45a Touch Screen Code TS05 - 1.10.3...

PT-2019-6186 · Struktur Ag +4 · Libde265 +4

Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.4 Description: The issue is related to a heap buffer overflow in the put weighted pred avg 16 fallback function of the libde265 video codec implementation. This can be exploited by a remote attacker using a specially...

PT-2019-6198 · None +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: libde265 version v1.0.4 Description: The issue is related to a heap buffer overflow in the put epel hv fallback function, which can be exploited via a crafted file, potentially allowing a remote attacker to cause a denial of service...