14261 matches found
Semrush: php info file and sql backup at vendor's subdomain
Researcher found open /phpinfo.php and sql backup from mvp app at vendor's subdomain. There was no sensitive data...
Maccms Cross-Site Request Forgery Vulnerability
Maccms is a PHP-based content management system CMS for film and television. A cross-site request forgery vulnerability exists in Macmms 10, which stems from the failure of the admin.php/admin/type/info.html page in the product to verify that requests originate from trusted users. An attacker cou...
OESA-2021-1364 wpa_supplicant security update
wpasupplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 IEEE 802.11i / RSN. It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key...
Srware Credential Gatherer
This module searches for Srware credentials on a Windows host. SRWare Iron is a Chromium-based web browser developed by the German company SRWare. Module Options msf use post/windows/gather/credentials/srware msf postsrware show actions ...actions... msf postsrware set ACTION msf postsrware show...
CVE-2021-29366
A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file...
CVE-2021-29366
A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file...
CVE-2021-23054
On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting XSS vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system...
openexr:openexr_exrcheck_fuzzer: Negative-size-param in Imf_3_1::memstream_read
Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5235723234574336 Project: openexr Fuzzing Engine: honggfuzz Fuzz Target: openexrexrcheckfuzzer Job Type: honggfuzzasanopenexr Platform Id: linux Crash Type: Negative-size-param Cra...
PT-2021-23315 · D Link · Dcs-932L +1
Name of the Vulnerable Software and Affected Versions: DCS-5000L version 1.05 and earlier DCS-932L version 2.17 and earlier Description: The issue is related to incorrect access control, allowing malicious users on the LAN to access the device due to the use of basic authentication for the device...
Information disclosure
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information...
CVE-2021-22012
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information...
nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()
A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...
nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()
A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...
CLSA-2021-1632262269 Fix of CVE: CVE-2021-34693, CVE-2021-20292, CVE-2021-28972, CVE-2021-20265, CVE-2021-32399, CVE-2014-4508, CVE-2021-3612, CVE-2021-3178, CVE-2021-37159, CVE-2021-38205, CVE-2021-3573, CVE-2021-38160
ELSCVE-666: CVE-2021-34693: can: bcm: fix infoleak in struct bcmmsghead - ELSCVE-705: CVE-2021-38160: virtioconsole: Assure used length from device is limited - ELSCVE-769: CVE-2014-4508: x8632, entry: Do syscall exit work on badsys CVE-2014-4508 - ELSCVE-844: CVE-2021-3573: Bluetooth: use...
Epik Confirms Hack, Gigabytes of Data on Offer
Epik, the domain registrar known for hosting several large right-wing organizations, has confirmed a hack of its systems, a week after attackers branding themselves part of the Anonymous hacktivist collective said that they had obtained and leaked gigabits of data from the hosting company,...
CVE-2019-19117
creationtimestamp| type| source ---|---|--- 2021-09-21 06:42:47+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/181 2024-02-23 15:41:46+00:00| seen| https://t.me/ctinow/191833...
WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting
The plugin does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against...
CVE-2021-38899
IBM Cloud Pak for Data 2.5 could allow a local user with special privileges to obtain highly sensitive information. IBM X-Force ID: 209575...
UBUNTU-CVE-2021-39593
An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function swfFontExtractDefineFontInfo located in swftext.c. It allows an attacker to cause Denial of Service...
CVE-2021-39593
An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function swfFontExtractDefineFontInfo located in swftext.c. It allows an attacker to cause Denial of Service...