CVE-2021-38416

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed...

Code injection

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed...

CVE-2021-38416

Delta Electronics DIALink vulnerable to DLL hijacking due to insecure loading of libraries in version 1.2.4.0 and earlier, enabling potential system takeover on the installed software. Affected product: DIALink industrial automation server. Root cause: uncontrolled search path element loading lib...

CVE-2021-38416 Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed...

DEBIAN-CVE-2021-38502

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

PHP Melody 3.0 - (Multiple) Cross-Site Scripting Vulnerability

Exploit Title: PHP Melody 3.0 - 'Multiple' Cross-Site Scripting XSS Vendor Homepage: https://www.phpsugar.com/phpmelody.html Version: v3 Product & Service Introduction: =============================== Upload, import, stream or embed any media. The smart way to manage audio & video. Comes with all...

Simplephpscripts Simple CMS 2.1 - (Multiple) Stored Cross-Site Scripting Vulnerability

Exploit Title: Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting XSS Vendor Homepage: https://simplephpscripts.com/simple-cms-php Version: 2.1 Product & Service Introduction: =============================== The system could be used only in already existing websites to contr...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2021-2623)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-42754

An improper control of generation of code vulnerability CWE-94 in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file...

CVE-2021-42754

An improper control of generation of code vulnerability CWE-94 in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file...

aDLL - Adventure of Dinamic Link Library

aDLL is abinary analysis tool focused on the automatic discovery of DLL Hijacking vulnerabilities. The tool analyzes the image of the binary loaded in memory to search for DLLs loaded at load-time and makes use of the Microsoft Detours library to intercept calls to the LoadLibrary/LoadLibraryEx...

Huawei Emui and Magic UI Hijacking Unauthenticated Provider Vulnerability

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. A security vulnerability exists in Huawei Emui and Magic UI, which stems from the existence of a hijacking unauthenticated provider vulnerability that can be...

EulerOS 2.0 SP8 : c-ares (EulerOS-SA-2021-2623)

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output ...

CVE-2021-31848

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...

CVE-2021-31848

CVE-2021-31848 is an XSS vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to version 11.7.100. The issue allows an attacker to hijack an active DLP ePO administrator session by convincing a logged-in admin to click a crafted link in the case-management portion of the extensi...

PHPJabbers Simple CMS 5 Cross Site Scripting

Document Title: =============== PHPJabbers Simple CMS v5 - Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2300 Release Date: ============= 2021-10-28 Vulnerability Laboratory ID VL-ID: ====================================...

My Movie Collection Sinatra App Login Cross Site Scripting

Document Title: =============== My Movie Collection Sinatra App - Login XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2293 Release Date: ============= 2021-11-01 Vulnerability Laboratory ID VL-ID: ==================================...

ASB-A-180745296

In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2021-22037

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path...

CVE-2021-22037

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path...