GitLab Information Disclosure Vulnerability (CNVD-2019-30784)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

GGPowerShell / Windows PowerShell Remote Command Execution Exploit

This python script mints a .ps file with an exploitable semicolon condition that allows for command execution from Microsoft Windows PowerShell. from base64 import b64encode from base64 import b64decode from socket import import argparse,sys,socket,struct,re GGPowerShell Microsoft Windows...

jenkins: CSRF protection tokens did not expire (SECURITY-626)

A flaw was found in Jenkins in weekly versions prior to 2.186 and LTS versions prior to 2.176.2. By default, CSRF tokens in Jenkins only checked user authentication and IP address which allowed attackers able to obtain a CSRF token for another user. This allowed an attacker to implement CSRF...

Scientific Linux Security Update : kde-workspace on SL7.x x86_64 (20190806)

Security Fixes : - kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element CVE-2018-6790 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128224; scriptversion"1.4";...

CVE-2019-15060

The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field...

Remote code execution

The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field...

CVE-2019-15060

The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field...

CVE-2015-9335

The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...

Sql injection

The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...

CVE-2015-9335

CVE-2015-9335 : A SQL injection vulnerability exists in the WordPress limit-attempts plugin prior to version 1.1.1 during IP address handling. This affects the plugin used with WordPress, enabling potentially unauthorized SQL commands through crafted input. The CVSS indications show high impact (...

CVE-2019-15238

The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field...

CVE-2019-15238

The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field...

Cross site request forgery (csrf)

The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field...

CVE-2019-15238

The entry CVE-2019-15238 concerns the WordPress plugin cforms2 (pre-15.0.2). A CSRF weakness is reported related to the IP address field, affecting the plugin before 15.0.2. The affected component is the cforms2 plugin for WordPress; root cause is CSRF in handling the IP address field. The connec...

The Rise of “Bulletproof” Residential Networks

Cybercrooks increasingly are anonymizing their malicious traffic by routing it through residential broadband and wireless data connections. Traditionally, those connections have been mainly hacked computers, mobile phones, or home routers. But this story is about so-called "bulletproof residentia...

GAME OVER: Detecting and Stopping an APT41 Operation

In August 2019, FireEye released the “Double Dragon” report on our newest graduated threat group, APT41. A China-nexus dual espionage and financially-focused group, APT41 targets industries such as gaming, healthcare, high-tech, higher education, telecommunications, and travel services. APT41 is...

CVE-2019-15116

The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging...

CVE-2019-15116

The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging...

Design/Logic Flaw

The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging...

CVE-2019-15116

CVE-2019-15116 affects the WordPress Easy Digital Downloads plugin prior to version 2.9.16. The vulnerability is a cross-site scripting (XSS) flaw associated with how IP addresses are logged, and multiple sources describe it as stored XSS. Impact is client-side script execution when vulnerable da...