Exploit for SQL Injection in Cacti

CVE-2020-14295 Vulnerability details - https://github.com/...

CVE-2021-3508

CVE-2021-3508 affects PDFResurrect 0.22b; a crafted PDF can trigger an infinite loop in get_xref_linear_skipped() in pdf.c. Documents do not specify exploitation status or a fix; no patch details are provided in the supplied sources. Monitor for updates and vendor advisories for remediation.

CVE-2021-30169

CVE-2021-30169 affects Merit Lilin IP cameras (MERIT LILIN ENT.CO.,LTD; P2/Z2/P3/Z3 variants). The issue is a vulnerability where sensitive information from the webcam device is not properly protected, enabling a remote attacker to unauthentically grant a user’s credential. The core problem is im...

Zivif webcams 信息泄露漏洞

Zivif webcams is a webcam device. The webcam device suffers from an information disclosure vulnerability that stems from the fact that sensitive information on the webcam device is not properly protected. A remote attacker could improperly grant administrator privileges and take further control o...

Weak password vulnerability in VRM of Bosch (China) Investment Co.

Bosch China Investment Co., Ltd. operates in the fields of machinery manufacturing, light industry, electronics and information industry. A weak password vulnerability exists in the VRM of Bosch China Investment Co. Ltd. that can be exploited by attackers to obtain sensitive information...

CVE-2021-29474

CVE-2021-29474 affects HedgeDoc (CodiMD). The vulnerability allows a relative path traversal via an improper input validation in the note creation flow: an URL-encoded alias is passed through the router into noteController.showNote, then into findNote/parseNoteId, ultimately using a possibly unva...

CVE-2021-20432

CVE-2021-20432 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.7. The vulnerability arises from a misconfigured Cross-Origin Resource Sharing (CORS) policy that does not restrict the domain name to trusted domains, potentially enabling an attacker to perform privileged actions and exfiltra...

CVE-2021-21219

CVE-2021-21219 concerns uninitialized data in PDFium used by Google Chrome prior to 90.0.4430.72, enabling a remote attacker to glean potentially sensitive information from process memory via a crafted PDF. The connected documents corroborate this information-disclosure impact via PDFium across C...

SlackPirate - Slack Enumeration And Extraction Tool - Extract Sensitive Information From A Slack Workspace

This is a tool developed in Python which uses the native Slack APIs to extract 'interesting' information from a Slack workspace given an access token. As of May 2018, Slack has over 8 million customers and that number is rapidly rising - the integration and 'ChatOps' possibilities are endless and...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2020-5258)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2020-7036

The CVE-2020-7036 entry describes an XML External Entities (XXE) vulnerability in Avaya Callback Assist. An authenticated, remote attacker could gain read access to information stored on affected systems. Affected are Callback Assist 4.0.x series prior to 4.7.1.1 Patch 7. Remediation: update to 4...

CVE-2020-7035

CVE-2020-7035 describes an XML External Entities (XXE) vulnerability in the web-based user interface of Avaya Aura Orchestration Designer. An authenticated, remote attacker can gain read access to information stored on an affected system. Affected are Avaya Aura Orchestration Designer 7.x version...

CVE-2021-31539

CVE-2021-31539 affects Wowza Streaming Engine prior to 4.8.8.01. In default installations, cleartext passwords are stored in conf/admin.password, allowing a local user to read usernames and passwords. Multiple connected sources confirm the issue and reference the 4.8.8.01 release as the fix. Reme...

CVE-2021-2226 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2021-2208 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2021-2316

CVE-2021-2316 affects Oracle E-Business Suite, specifically Oracle HRMS (France) French HR, with affected versions 12.1.1–12.1.3. The vulnerability is exploitable over HTTP by a low-privilege attacker with network access, potentially leading to unauthorized creation, deletion or modification of d...

CVE-2021-2310

CVE-2021-2310 affects Oracle VM VirtualBox (Core) with impact described as takeover of VirtualBox. Affected releases are prior to 6.1.20. The vulnerability is exploitable by a high-privilege attacker who already has logon to the infrastructure where VirtualBox runs; exploitation can compromise th...

CVE-2021-2288

CVE-2021-2288 affects the Oracle Bills of Material component (Bill Issues) in Oracle E-Business Suite, for versions 12.1.1–12.1.3. The flaw allows a low-privileged, network-accessible attacker over HTTP to compromise Oracle Bills of Material, enabling unauthorized creation, deletion or modificati...

CVE-2021-2226

CVE-2021-2226 affects Oracle MySQL Server (Server: Information Schema). Affected: MySQL 5.7.33 and older, 8.0.23 and older. Description in the provided docs notes an easily exploitable issue that could allow a high-privileged attacker with network access via multiple protocols to compromise data ...

CVE-2020-27738

CVE-2020-27738 concerns the DNS domain name record decompression in Siemens APOGEE PXC/TALON, Nucleus, SIMOTICS CONNECT 400 and related DNS modules. The issue is improper validation of pointer offsets during DNS response parsing, which can cause a read past the end of an allocated structure and l...