Security Bulletin: A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23449 DESCRIPTION: Node.js vm2 module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or...

Ubuntu: Security Advisory (USN-5165-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Neutralization of Formula Elements in a CSV File in html-2-csv

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands vi...

CVE-2020-7879

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie'COOKIE' . The value is transferred to the --header option in wget binary, and there is no validation check...

CVE-2020-7879 ipTIME C200 IP Camera command injection vulnerability

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie'COOKIE' . The value is transferred to the --header option in wget binary, and there is no validation check...

elecom lan 跨站脚本漏洞

elecom lan is a router from Elecom Japan. A cross-site scripting vulnerability exists in elecom lan that stems from insufficient cleaning of user-supplied data. An authenticated, remote attacker could trick a victim into visiting specially crafted links within the context of a vulnerable website...

Cross-site Scripting (XSS)

htmltocsv is vulnerble to cross-site scripting. The vulnerability exists through the formula embedded in a HTML page does not properly validate the input, allowing an attacker to embed or generate a malicious link or execute commands via CSV files...

ManageEngine ADSelfService Plus Authentication Bypass / Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine ADSelfService Plus CVE-2021-40539', 'Description' = %q This module exploits CVE-2021-40539, a REST API authentication bypass...

CVE-2021-36311

Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user with networker user privileges may exploit this vulnerability to upload malicious file to unauthorized locations and execute it...

CVE-2021-36311

Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user with networker user privileges may exploit this vulnerability to upload malicious file to unauthorized locations and execute it...

Open-xchange OX App Suite Code Injection Vulnerability

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A code injection vulnerability exists in Open-xchange OX App Suite, which can be exploited by attacker...

Commvault CommCell Remote Code Execution Vulnerability

Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.A remote code execution vulnerability exists in the DemoExecuteProcessOnGroup workflow in versions of Commvault CommCell prior to 11.25, which could be exploited by an attacker t...

The vulnerability of the Google Chrome browser’s media component, which allows a hacker to execute arbitrary code.

The vulnerability of the Google Chrome browser’s media component is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created web page...

Design/Logic Flaw

A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DWG files. The issue results from the lack of validating the existence of an object prior to performing operations on the...

Commvault CommCell 安全漏洞

Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.A remote code execution vulnerability exists in the DemoExecuteProcessOnGroup workflow in versions of Commvault CommCell prior to 11.25, which could be exploited by an attacker t...

[SECURITY] [DLA 2824-1] firebird3.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2824-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler November 20, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2824-1 : firebird3.0 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2824 advisory. - An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement. CVE-2017-11509 Note th...

KLA12351 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, spoof user interface, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Use aft...

OffensiveRust

This is a collection of Rust code snippets, each implementing a different type of exploit or malicious functionality. The code is organized into several subdirectories, each containing a specific exploit or tool. Here's a summary of the code and its functionality: 1. AllocateWithSyscalls: This co...

CVE-2021-3918

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...