CVE-2021-35528

CVE-2021-35528 — Hitachi Energy Retail Operations/CSB is an improper access control vulnerability (CWE-284) in the application’s authentication/authorization that relies on local session validation, enabling an unauthorized, signed Java Applet JAR to be executed. Affected versions: Hitachi Energy...

Debian: Security Advisory (DSA-5008-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-43493

ServerManagement master branch as of commit 49491cc6f94980e6be7791d17be947c27071eb56 is affected by a directory traversal vulnerability. This vulnerability can be used to extract credentials which can in turn be used to execute code...

[SECURITY] [DSA 5008-1] node-tar security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5008-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 11, 2021 https://www.debian.org/security/faq -...

gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location...

ALSA-2021:4316 Low: zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fixes: zziplib: infinite loop via the return value of zzipfileread as used in unzzipcatfile CVE-2020-18442 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and othe...

Critical Flaws in Philips TASY EMR Could Expose Patient Data

The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning of critical vulnerabilities affecting Philips Tasy electronic medical records EMR system that could be exploited by remote threat actors to extract sensitive personal data from patient databases. "Successful exploitation of...

Sql injection

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcementsstudent.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code...

CVE-2021-42667

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in som...

CVE-2021-42667

CVE-2021-42667 affects Sourcecodester Online Event Booking and Reservation System (version 2.3.0). The vulnerability is an SQL Injection in the event-management/views component, exploitable via the vulnerable id parameter on the USER page, enabling an attacker to manipulate SQL queries, potential...

Engineers Online Portal SQL注入漏洞

Sourcecodester Engineers Online Portal is an open source online portal. Sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection, which can be exploited by attackers to extract sensitive data from the web server via the announcesstudent.php id parameter of announcesstudent.php...

Engineers Online Portal SQL注入漏洞

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students, and instructors. sourcecodester Online Event Booking and...

Engineers Online Portal SQL注入漏洞

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection, which can be exploited by attackers to extract sensitive data from the Web server via the id parameter of myclassmates.php, and in some cases...

Engineers Online Portal SQL注入漏洞

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection. An attacker can exploit the vulnerability to extract sensitive data from the web server via the id parameter of quizquestion.php and, in some cases...

Androidqf - (Android Quick Forensics) Helps Quickly Gathering Forensic Evidence From Android Devices, In Order To Identify Potential Traces Of Compromise

androidqf Android Quick Forensics is a portable tool to simplify the acquisition of relevant forensic data from Android devices. It is the successor of Snoopdroid, re-written in Go and leveraging official adb binaries. androidqf is intended to provide a simple and portable cross-platform utility ...

CVE-2021-35528

Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Billing CSB allows an attacker to execute a modified signed Java Applet JAR file. A successful exploitation may lead to data extraction or...

Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign

The Mekotio Latin American banking trojan is bouncing back after several of the gang that operates it were arrested in Spain. More than 100 attacks in recent weeks have featured a new infection routine, indicating that the group continues to actively retool. “The new campaign started right after...

Ivanti Pulse Connect Secure Code Execution Vulnerability

Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction...

CVE-2021-37808

SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the 1 category, 2 subcategory, 3 sucatdescription, and 4 username parameters, the server response is about N seconds delay respectively which mean it is vulnerable to MySQL Blind Time Based. An attacker can...

Vehicle Parking Management System SQL注入漏洞

Vehicle Parking Management System is an open source vehicle parking management system from the individual developer Anuj Kumar. Vehicle Parking Management System affected version 1.0 suffers from a SQL injection vulnerability that can be further exploited to extract sensitive information from the...