CVE-2020-26131

Issues were discovered in Open DHCP Server Regular 1.75 and Open DHCP Server LDAP Based 0.1Beta. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenDHCPServer.exe Regular or the OpenDHCPLdap.exe LDAP Based binary...

PT-2020-16306 · Home · Home Dns Server

Name of the Vulnerable Software and Affected Versions: Home DNS Server version 0.10 Description: An issue was discovered due to insufficient access restrictions in the default installation directory, allowing an attacker to elevate privileges by replacing the HomeDNSServer.exe binary...

Ghisler Total Commander Elevation of Privilege Vulnerability

Ghisler Total Commander is a file manager software from the American company Ghisler. The program offers file compression, management, ftp sharing and more. An elevation of privilege vulnerability exists in Ghisler Total Commander version 9.51, which stems from insufficient access restrictions in...

Buffer Overflow Vulnerability in ForceControl ForceControl httpsvr.exe

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. A buffer overflow vulnerability exists in ForceControl httpsvr.exe, which can be exploited by an attacker to cause a remote denial of service attack...

CVE-2020-17381

An issue was discovered in Ghisler Total Commander 9.51. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the %SYSTEMDRIVE%\totalcmd\TOTALCMD64.EXE binary...

EulerOS Virtualization 3.0.2.2 : libffi (EulerOS-SA-2020-2186)

According to the version of the libffi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Plea...

CVE-2020-24416 Blind stored XSS in Marketo Sales insight plugin for SalesForce

Marketo Sales Insight plugin version 1.4355 and earlier is affected by a blind stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to...

ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution

!/usr/bin/env python3 -- coding: utf-8 -- ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution Vendor: ReQuest Serious Play LLC Product web page: http://www.request.com Affected version: 7.0.3.4968 Pro 7.0.2.4954 6.5.2.4954 6.4.2.4681 6.3.2.4203 2.0.1.823 Summary: F3...

Path Traversal Vulnerability in Pocket Watcher Collection Side

Pocket Viewer is a surveillance app that allows users to turn their cell phones, computers, smart TVs and other devices into wireless home surveillance by using the companion software "Pocket Viewer Capture Terminal". There is a path traversal vulnerability in the Pocket Watcher app, which can be...

CVE-2020-26880

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file which is owned by sympa and parsing it through the setuid sympanewaliases-wrapper executable...

CVE-2020-26880

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file which is owned by sympa and parsing it through the setuid sympanewaliases-wrapper executable...

UBUNTU-CVE-2020-26880

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file which is owned by sympa and parsing it through the setuid sympanewaliases-wrapper executable...

CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...

CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...

[SECURITY] Fedora 32 Update: pandoc-citeproc-0.16.2-2.fc32

The pandoc-citeproc library supports automatic generation of citations and a bibliography in pandoc documents using the Citation Style Language CSL ma cro language. More details on CSL can be found at . In addition to a library, the package includes an executable, pandoc-citepr oc, which works as...

InfoCage SiteShell installs their files with improper access permissions

Overview InfoCage SiteShell provided by NEC Corporation installs their files with improper access permissions CWE-732. Especially, the service executable files can be modified by Everyone users. NEC Corporation reported this vulnerability to IPA to notify users of its solution through JVN...

[SECURITY] Fedora 33 Update: pandoc-citeproc-0.17.0.1-3.fc33

The pandoc-citeproc library supports automatic generation of citations and a bibliography in pandoc documents using the Citation Style Language CSL ma cro language. More details on CSL can be found at . In addition to a library, the package includes an executable, pandoc-citepr oc, which works as...

EulerOS Virtualization for ARM 64 3.0.6.0 : perl-Encode (EulerOS-SA-2020-2046)

According to the version of the perl-Encode packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that perl can load modules from the current directory if not found in the module directories, via the...

Huawei EulerOS: Security Advisory for perl-Module-Load-Conditional (EulerOS-SA-2020-2013)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : libffi (EulerOS-SA-2020-2113)

According to the version of the libffi packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that...