CVE-2018-5739

An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facilities. In order to support multiple requests simultaneously, Kea 1.4 added a callout handle store but unfortunately the initial implementation of this stor...

CVE-2018-5739

An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facilities. In order to support multiple requests simultaneously, Kea 1.4 added a callout handle store but unfortunately the initial implementation of this stor...

CVE-2018-5739

CVE-2018-5739 is a memory-leak issue in Kea DHCP 1.4.0 related to the callout handle store. The initial implementation of the store does not always free memory, allowing memory usage to grow when hooks using query4 or query6 parameters are invoked, potentially exhausting server memory and causing...

Remote Code Execution (RCE)

github.com/golang/go is vulnerable to remote code execution RCE. If custom domains are used, a malicious user can set a domain example.com/proj1 to point to a subversion repository and another domain example.com/proj1/proj2 to point to a git repository. When the go get command is run, arbitrary...

Pe-Sieve - Recognizes And Dumps A Variety Of Potentially Malicious Implants (Replaced/Injected PEs, Shellcodes, Hooks, In-Memory Patches)

PE-sieve is a light-weight tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory...

SugarCRM Web Logic Hooks Module PHP Code Injection Vulnerability

SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a PHP code injection vulnerability. User input passed through the "triggerevent" parameter is not properly sanitized before being used to save PHP code into the 'logichooks.php' file through the Web Logic Hooks module. This can be...

SugarCRM (Web Logic Hooks module) Path Traversal Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A path traversal...

SugarCRM (Web Logic Hooks module) PHP Code Injection Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A PHP code...

SugarCRM Web Logic Hooks Module Path Traversal Vulnerability

SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a path traversal vulnerability. User input passed through the "webhooktargetmodule" parameter is not properly sanitized before being used to save PHP code into the hooks file through the Web Logic Hooks module. This can be exploited...

SugarCRM Web Logic Hooks Module Path Traversal

-------------------------------------------------------------- SugarCRM Web Logic Hooks module Path Traversal Vulnerability -------------------------------------------------------------- - Software Link: http://www.sugarcrm.com - Affected Versions: All versions prior to 7.9.5.0, 8.0.2, and 8.2.0....

SugarCRM Web Logic Hooks Module PHP Code Injection

------------------------------------------------------------------ SugarCRM Web Logic Hooks module PHP Code Injection Vulnerability ------------------------------------------------------------------ - Software Link: http://www.sugarcrm.com - Affected Versions: All versions prior to 7.9.5.0, 8.0.2...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the lack of sanitization on file names, where uploading a malicious file allows attacker to become another user and subsequently using hooks to perform RCE attacks...

PrestaShop PM_ModalCart 1.6.1.4 Database Disclosure

Exploit Title : PrestaShop PMModalCart 1.6.1.4 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 24/12/2018 Vendor Homepage : prestashop.com Software Download Link : addons.prestashop.com/ru/pop-up/2438-modal-cart-3.html +...

DRUPAL-CONTRIB-2018-081

This module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when responding to certain filtered collection requests, thereby causing an access bypass vulnerability. This mea...

JSON:API - Moderately critical - Access bypass - SA-CONTRIB-2018-081

This module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when responding to certain filtered collection requests, thereby causing an access bypass vulnerability. This mea...

LoginPress <= 1.1.15 - Authenticated Blind SQL Injection

Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site including subscriber profiles. 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused...

Trape v2.0 - People Tracker On The Internet: OSINT Analysis And Research Tool

Trape is a OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how large Internet companies could obtain confidential information such as the status of sessions of their...

WP AMP plug-in vulnerability analysis-vulnerability warning-the black bar safety net

The researchers found the WordPress plug-in AMP for WP – Accelerated Mobile Pages the presence of vulnerabilities. AMP is to move the page to the acceleration of the mean, is a by Google the company launched speed up mobile page load speed of the project, you can let the mobile terminal in the...

Popular AMP Plugin for WordPress Patches Critical Flaw – Update Now

A security researcher has disclosed details of a critical vulnerability in one of the popular and widely active plugins for WordPress that could allow a low-privileged attacker to inject malicious code on AMP pages of the targeted website. The vulnerable WordPress plugin in question is "AMP for W...

Popular AMP Plugin for WordPress Patches Critical Flaw – Update Now

A security researcher has disclosed details of a critical vulnerability in one of the popular and widely active plugins for WordPress that could allow a low-privileged attacker to inject malicious code on AMP pages of the targeted website. The vulnerable WordPress plugin in question is "AMP for W...