Simple Online College Entrance Exam System 1.0 - SQLi Authentication Bypass

Exploit Title: Simple Online College Entrance Exam System 1.0 - SQLi Authentication Bypass Date: 07.10.2021 Exploit Author: Mevlüt Yılmaz Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html Software Link:...

CVE-2021-42049

The CVE-2021-42049 entry concerns MediaWiki’s Translate extension (up to version 1.36.2). The root cause is an oversight-related permission flaw that lets oversighters undo or miss-oversight on pages with suppressed info (e.g., PII), effectively whitewashing revisions. The documented impact is a ...

CVE-2021-0689

In RGBtoBGR1portable of SkSwizzleropts.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2021-41554

ARCHIBUS Web Central 21.3.3.815 suffers improper access control: requests to /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, and /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw do not verify p...

CVE-2021-39884

CVE-2021-39884 affects GitLab Enterprise Edition (EE) back to 8.13; an endpoint reveals the names of private groups that have access to a project to low-privilege users embedded in that project. The root cause and exact vulnerable component are not expanded beyond “an endpoint discloses group nam...

CVE-2021-39882

CVE-2021-39882 affects all versions of GitLab CE/EE, enabling anonymous users to access endpoints that disclose information about any GitLab user. The root cause is an information-disclosure flaw where providing a user ID allows exposure of user data via multiple endpoints. The available document...

blog-www60-61-prod

...

CVE-2021-41092

CVE-2021-41092 describes a Docker CLI vulnerability where docker login against a misconfigured credentials store (credsStore/credHelpers) could cause credentials to be sent to registry-1.docker.io instead of a private registry. The issue affects the Docker CLI and was fixed in Docker CLI 20.10.9....

CVE-2021-25964

CVE-2021-25964 affects Calibre-web versions 0.6.0–0.6.12. A stored XSS vulnerability exists in the Metadata description field; an attacker with permission to edit metadata can inject JavaScript, which is triggered when a victim opens the file. This is the documented impact in multiple connected s...

ASB-A-184561359

Bulletin has no description...

ASB-A-190404407

Bulletin has no description...

CVE-2021-41293

The ECOA Building Automation System (BAS) controller is affected by a path traversal/arbitrary file disclosure vulnerability. Affected component/file: viewlog.jsp; attack vector is via the POST parameter fname, allowing an unauthenticated attacker to disclose arbitrary files and sensitive system ...

CVE-2020-20128

Summary: CVE-2020-20128 affects LaraCMS v1.0.1, where sensitive information is transmitted in cleartext, potentially allowing interception. The entry lists CVSS v3.1 BaseScore 7.5 (High) and CVSS2 BaseScore 5.0 (Medium) with network attack vector and low complexity. Multiple connected sources des...

QID Spotlight: Discover Azul Java Vulnerabilities

The Qualys vulnerability signatures team has released a new series of signatures detections for Azul Java, allowing security teams to identify Azul Java hosts and detect their vulnerabilities. Azul is a Java platform used for modern cloud enterprises. The platform is used for developing,...

Path traversal

Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and gain access to unauthorized information...

CVE-2021-21569

Dell EMC NetWorker 18.x and 19.x are affected by CVE-2021-21569, a path traversal vulnerability in the NetWorker server that could allow a remote client with server access to access unauthorized information (confidentiality impact). Public sources in the connected documents confirm the remediatio...

CVE-2021-37271

CVE-2021-37271 affects UEditor v1.4.3.3, with a Cross Site Scripting (XSS) vulnerability that can be exploited to obtain a user’s cookies. The connected documents confirm the product/version and the impact but do not provide detailed exploit steps, vectors, or remediation information. No public d...

elearning211.unsri.ac.id Cross Site Scripting vulnerability OBB-2151516

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2021-0425

CVE-2021-0425 relates to a side-channel information disclosure in the memory management driver, enabling local information disclosure without user interaction. The vulnerability affects the memory-management component and is tied to the Mediatek ecosystem per linked advisories. The root cause is ...

CVE-2021-0423

CVE-2021-0423 concerns an information disclosure in the Mediatek memory management driver due to uninitialized data. This can enable local information disclosure with no additional execution privileges and without user interaction. The vulnerability is documented across multiple sources including...