Faulty Evaluation System 1.0 - (multiple) Stored Cross-Site Scripting Vulnerability

Exploit Title: Faulty Evaluation System 1.0 - 'multiple' Stored Cross-Site Scripting Exploit Author: Suresh Kumar Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14710/faulty-evaluation-system-using-phpcodeigniter-source-code.html Software: Fault...

Microsoft Pulls Bad Windows Update After Patch Issue

Microsoft has removed a faulty servicing stack update, which was causing issues for Windows users when they tried to install last week’s Patch Tuesday security updates. Microsoft’s servicing stack update provides fixes for the component that installs Windows updates. This particular defective...

CVE-2021-25630

"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case. In the vulnerable version of "loolforkit" this...

ProjectSend Security Vulnerability

ProjectSend formerly cFTP is a suite of self-hosted applications based on PHP and MySQL. ProjectSend before r1295 suffers from a security vulnerability that incorrectly resets passwords due to faulty business logic...

Dexidp Dex Data Forgery Issue Vulnerability

Dexidp Dex is a Go-based language used for secure authentication via OpenId by the Dexidp team. Versions of Dex prior to 2.27.0 have security vulnerabilities that stem from faulty XML encoding in the underlying Go libraries, which affects the user's ability to utilize the SAML connector. These...

The vulnerability of the Session Initiation Protocol (SIP) implementation in Cisco TelePresence Video Communication Server and Cisco Expressway Series devices allows a attacker to induce a service failure.

The vulnerability of the Session Initiation Protocol SIP implementation of Cisco TelePresence Video Communication Server and Cisco Expressway Series devices is related to errors in processing incoming SIP traffic. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Scratch Addons Cross-Site Scripting Vulnerability

Scratch Addons is a plugin from the Scratch Addons community for providing theme changing functionality for browsers. The addon supports Chrome and Firefox browsers. A cross-site scripting vulnerability exists in Scratch Addons, which stems from the use of incorrect regular expressions, which can...

PT-2020-4809 · Microsoft · Av1 Video Extension

Name of the Vulnerable Software and Affected Versions: AV1 Video Extension affected versions not specified Description: The issue is related to incorrect code generation management in the AV1 Video Extension codec. It may allow a remote attacker to execute arbitrary code. Recommendations: At the...

Intel PAC with Arria 10 GX FPGA Elevation of Privilege Vulnerability

Intel PAC with Arria 10 GX FPGA and Intel Acceleration Stack are both products of Intel Corporation, U.S.A. Intel PAC with Arria 10 GX FPGA is a programmable acceleration card that uses Intel Arria 10 GX FPGAs Field Programmable Gate Arrays. Intel Acceleration Stack is an acceleration stack that...

Intel Server Board Elevation of Privilege Vulnerability

Intel Server Board is a server motherboard from Intel Corporation USA. An elevation of privilege vulnerability exists in the BIOS firmware in Intel Server Board Families S2600ST, S2600BP, and S2600WF, which stems from a faulty initialization. A local attacker could exploit the vulnerability to...

The vulnerability of the Google Chrome browser downloader, which allows a hacker to access confidential data

The vulnerability of the Google Chrome browser downloader is related to the disclosure of information in an erroneous data field. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

Security lock can be bypassed by changing the system date

Given an attacker has physical access to the device, a faulty timestamp check allowed to bypass the app lock by setting the system date to the past...

Grafana Code Issues Vulnerabilities

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A remote code execution vulnerability exists in the avatar feature in Grafana versions...

ONAP Service Design and Creation Code Injection Vulnerability

ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in ONAP SDC Dublin and prior versions that stems from faulty access control. A remote attacker can exploit this vulnerability by accessing port 7000 of the...

ONAP Service Design and Creation Code Injection Vulnerability (CNVD-2020-24673)

ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in ONAP SDC Dublin and prior versions that stems from faulty access control. A remote attacker can exploit this vulnerability by accessing port 7001 of the...

Cisco Email Security Appliance Denial of Service Vulnerability

The Cisco Email Security Appliance ESA is an email security appliance from Cisco USA. A denial of service vulnerability exists in the email message scanning feature in Cisco ESA and Cisco Cloud Email Security versions prior to 12.5.1-037 and prior to 13.0.0-375, which stems from a faulty parsing...

Unspecified Vulnerability in IBM MQ and IBM MQ Appliance

IBM MQ IBM WebSphere MQ and IBM MQ Appliance are both products of IBM Corporation, U.S.A. IBM MQ is a messaging middleware product. The product focuses on providing a reliable and proven messaging backbone for Service Oriented Architecture SOA.IBM MQ Appliance is an all-in-one appliance for rapid...

CVE-2019-2036

In okToConnect of HidHostService.java, there is a possible permission bypass due to an incorrect state check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0...

CVE-2019-2173

In startActivityMayWait of ActivityStarter.java, there is a possible incorrect Activity launch due to an incorrect permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2019-3403

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check...