6929 matches found
Cross site scripting
A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as th...
Projectworlds House Rental SQL Injection Vulnerability
Projectworlds House Rental is a system used by the Projectworlds organization for house rental functionality. version 1.0 of Projectworlds House Rental is vulnerable to SQL injection, which can be exploited by remote attackers to make POST requests via a malicious index.php...
CVE-2020-15920
creationtimestamp| type| source ---|---|--- 2020-09-16 15:35:56+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/midasolutionseframeworkajaxreqrce.rb 2025-02-02 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities -...
Feds Warn Nation-State Hackers are Actively Exploiting Unpatched Microsoft Exchange, F5, VPN Bugs
The U.S. government is warning that Chinese threat actors have successfully compromised several government and private sector entities in recent months, by exploiting vulnerabilities in F5 BIG-IP devices, Citrix and Pulse Secure VPNs and Microsoft Exchange servers. Patches are currently available...
Remote code execution
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the...
Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63319)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server is a server operating system. Microsoft Windows/Windows Server has an information disclosure vulnerability that can be exploited by an...
Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-68746)
Microsoft Windows and Microsoft Windows Server are both products of the U.S. company Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. Microsoft Windows/Windows Server has an elevation of privilege vulnerability, which stems...
Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-68735)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. An elevation-of-privilege vulnerability exists in Microsoft Windows/Windows...
Microsoft Windows/Windows Server Denial of Service Vulnerability (CNVD-2021-66067)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. A denial of service vulnerability exists in Microsoft Windows/Windows Server. The vulnerability stems from...
CVE-2020-25213
The File Manager wp-file-manager plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload or mkfile and p...
Windows Runtime Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted...
Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the...
Facebook Debuts Third-Party Vulnerability Disclosure Policy
Facebook has implemented a fresh security vulnerability disclosure policy VDP this week – in an effort to explain how it decides when and how to roll out details on various bugs that its team finds in third-party software and open-source projects. Generally speaking, companies will have 21 days t...
CVE-2020-8576
Clustered Data ONTAP versions prior to 9.3P19, 9.5P14, 9.6P9 and 9.7 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or disclosure of sensitive information...
Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager
Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...
Windows Inject PE Files, Reverse TCP Stager
Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...
Windows Inject PE Files, Reverse TCP Stager (DNS)
Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...
Windows Inject PE Files, Reverse TCP Stager (IPv6)
Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...
CVE-2020-25078
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure. Recent assessments: kevthehermit at March 04, 2021 12:03am UTC reported: Vulnerability The D-LInk...