Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2021-1487)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Totvs TOTVS Fluig 路径遍历漏洞

Totvs TOTVS Fluig is an application from the Portuguese company Totvs. It is used to automate ERP tasks. A path traversal vulnerability exists in TOTVS Fluig Luke 1.7.0 that allows directory traversal via base64 encoded files...

EulerOS Virtualization for ARM 64 3.0.6.0 : krb5 (EulerOS-SA-2021-1544)

According to the version of the krb5 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - MIT Kerberos 5 aka krb5 before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos...

EulerOS 2.0 SP2 : libksba (EulerOS-SA-2021-1317)

According to the versions of the libksba package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The appendutf8value function in the DN decoder dn.c in Libksba before 1.3.3 allows remote attackers to cause a denial of service out-of-bounds...

EulerOS 2.0 SP2 : krb5 (EulerOS-SA-2021-1312)

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - MIT Kerberos 5 aka krb5 before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the...

Backdoor.Win32.Agent.aak Hardcoded Credentials

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/64f2fd4dbd9039e5bc054f475eaa582a.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.aak Vulnerability: Weak Hardcoded Credentials Description: The HTTP backdoor...

UBUNTU-CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 where the HordeTextFilter library before 2.3.7 is used. The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke us...

Cross site scripting

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 where the HordeTextFilter library before 2.3.7 is used. The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke us...

Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF

The LikeBtn WordPress plugin was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery SSRF. On line 7493 in likebtnlikebutton.php a hook is set to allow unauthenticated ajax calls which will call the function likebtnprx. As the name suggests, this function works as a proxy and can ...

Authentication flaw

HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials...

CVE-2020-14246

HCL OneTest Performance V9.5, V10.0, V10.1 uses basic authentication which is relatively weak. An attacker could potentially decode the encoded credentials...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2021-1149)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-15834

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The wireless network password is exposed in a QR encoded picture that an unauthenticated adversary can download via the web-management interface...

CVE-2020-15834

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The wireless network password is exposed in a QR encoded picture that an unauthenticated adversary can download via the web-management interface...

Nagios XI 5.7.x Remote Code Execution

Exploit Title: Nagios XI 5.7.X - Remote Code Exection RCE Authenticated Date: 19/12/2020 Exploit Author: Haboob Team https://haboob.sa Vendor Homepage: https://www.nagios.com/products/nagios-xi/ Version: Nagios XI 5.7.x Tested on: Ubuntu 18.04 / PHP 7.2.24 & Vendor's custom VM CVE: CVE-2020-35578...

CVE-2021-3131

The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter...

Design/Logic Flaw

The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter...

CVE-2021-3131

The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter...

1c Enterprise Encryption Problem Vulnerability

1c Enterprise is a platform for handling business automation in corporate environments from 1c Germany. The platform handles activities in accounting, finance, human resources and management. A cryptographic issue vulnerability exists in 1C:Enterprise 8 8.3.17.1851, which stems from the program...

PT-2021-19235 · 1с · 1С:Предприятие +1

Name of the Vulnerable Software and Affected Versions: 1C:Enterprise 8 versions prior to 8.3.17.1851 Description: The issue concerns the Web server in 1C:Enterprise 8, which sends base64 encoded credentials in the creds URL parameter. Recommendations: For versions prior to 8.3.17.1851, update to...