Server side request forgery (ssrf)

An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address...

CVE-2021-33211

CVE-2021-33211 affects Elements-IT HTTP Commander 5.3.3, due to a path traversal flaw in the Unzip feature. The vulnerability allows remote authenticated users to write files to arbitrary directories by supplying relative paths inside ZIP archives, enabling potential data impact beyond the intend...

CVE-2021-33212

Elements-IT HTTP Commander 5.3.3 contains a cross-site scripting (XSS) flaw in the "View in Browser"/"Browser View" feature. A remote authenticated user can inject arbitrary script/HTML through a crafted SVG image. Documented impact is XSS with partial integrity impact; no patch/version remediati...

CVE-2021-33212

A Cross-site scripting XSS vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SVG image...

CVE-2021-33213

The CVE-2021-33213 entry documents an SSRF in Elements-IT HTTP Commander 5.3.3, specifically in the Upload from URL feature. When authenticated, an attacker can supply an internal address to retrieve HTTP/FTP resources from the internal network, exposing internal resources. Root cause: SSRF in th...

Elements-IT HTTP Commander 路径遍历漏洞

Elements-IT HTTP Commander is a server-hosted, web-based file management solution from Elements-IT Germany. It provides basic functionality for working with files creating, copying, deleting, etc. and many other additional features, such as integration with cloud services, online editing of Offic...

Elements-IT HTTP Commander 跨站脚本漏洞

Elements-IT HTTP Commander is a server-hosted, web-based file management solution from Elements-IT Germany. It provides basic functionality for working with files creating, copying, deleting, etc. and many other additional features, such as integration with cloud services, online editing of Offic...

Important: Red Hat Bug Fix Advisory: Red Hat Ansible Automation Platform Product Release

Red Hat Ansible Automation Platform 2.0 is now available. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automatio...

OpenEMR 5.0.1.3 - (manage_site_files) Remote Code Execution (Authenticated) Exploit (2)

Title: OpenEMR 5.0.1.3 - 'managesitefiles' Remote Code Execution Authenticated 2 Exploit author: noraj Alexandre ZANNI for SEC-IT http://secit.fr Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/v5013.tar.gz Docker PoC:...

The Everyday IT Tools That Can Offer ‘God Mode’ to Hackers

Attackers are increasingly attuned to the power and potential of remote management software...

How to Empower Employees to be Secure and Productive

How can CISOs make cybersecurity positive, productive, inclusive, and maintain best practices across the enterprise? -- Do your staff feel valued and important in their roles? More than 65 percent of employees report they do not feel recognized at work, and 31 percent say theyre "engaged but feel...

XSS vulnerability in Jinan Speed Information Technology Co.

Jinan Speed Information Technology Co., Ltd. was founded in 2010, is a network technology company focusing on user experience design and development and Internet branding. There is an XSS vulnerability in Jinan Speed Information Technology Co., Ltd.'s website building system, which can be exploit...

NinjaRMM Access Control Error Vulnerability

NinjaRMM is a remote monitoring and management software from NinjaRMM USA. Improve business efficiency by combining monitoring, alerting, patching, antivirus, backup and IT automation all in a single management platform. An Access Control Error vulnerability exists in NinjaRMM, which arises from...

Security update for libopenmpt (moderate)

openSUSE Security Update: Security update for libopenmpt Announcement ID: openSUSE-SU-2021:1914-1 Rating: moderate References: 1186663 Affected Products: openSUSE Leap 15.3 An update that contains security fixes can now be installed. Description: This update for libopenmpt fixes the following...

The Unfixed Flaw at the Heart of REvil’s Ransomware Spree

Security researchers warned Kaseya about its IT management software in April, but the patches didn't come fast enough to avert last week's disaster...

Shaanxi Silicon Peak Network Technology Co., Ltd. website building system has file upload vulnerability

Shaanxi Silicon Peak Network Technology Co., Ltd. was founded in 2007 is a "website design, software development, microblogging, Internet marketing, e-commerce" and other integrated information technology services in one of the high-end brand IT organizations. Shaanxi Silicon Peak Network...

Once Again, Rapid7 Named a Leader in 2021 Gartner Magic Quadrant for SIEM

Rapid7 is elated for InsightIDR to be recognized as a Leader in the 2021 Gartner Magic Quadrant for Security Information and Event Management SIEM. This is the second consecutive time our SaaS SIEM—InsightIDR—has been named a Leader in this report. Access the full complimentary report from us her...

Logic flaws exist in the management informationization practical training cloud platform of Changjie Tong Information Technology Co.

Stock Code: 1588.HK is a member company of UFIDA. Changjitong is committed to providing social, personalized, service-oriented and small business management support for small and medium-sized enterprises SMEs. A logic flaw vulnerability exists in the management informationization practical traini...

Csdn APP has XSS vulnerability

Csdn APP is an IT community software for cell phones. Csdn APP has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

Vulristics HTML Report Update: Table for Products, Table for Vuln. Types and “Prevalence”

Hi guys! I was on vacation this week. So I had time to work on my Vulristics project. For those who dont know, this is a framework for prioritizing known CVE vulnerabilities. I was mainly grooming the HTML report. I added a logo at the top, set a max width for the report, added a timestamp when t...