1365 matches found
Gallagher Group Command Centre Access Control Error Vulnerability
Gallagher Group Command Centre is a centralized control tool for Gallagher access control systems from Gallagher Group of New Zealand. An Access Control Error vulnerability exists in Gallagher Command Centre, which stems from an improper authentication vulnerability that allows an unauthenticated...
VulnCheck KEV: CVE-2020-17463
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
Moodle Cross-Site Scripting Vulnerability (CNVD-2020-65139)
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site scripting vulnerability that stems from the ability to include JavaScript when renaming content librar...
Moodle 跨站脚本漏洞
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site scripting vulnerability that stems from the ability to include JavaScript when renaming content librar...
Pandora FMS 7.0 NG 749 SQL Injection
Exploit Title: Pandora FMS 7.0 NG 749 - 'CG Items' SQL Injection Authenticated Date: 11-14-2020 Exploit Author: Matthew Aberegg, Alex Prieto Vendor Homepage: https://pandorafms.com/ Patch Link: https://github.com/pandorafms/pandorafms/commit/1258a1a63535f60924fb69b1f7812c678570cc8e Software Link:...
PT-2020-16164 · Moodle +1 · Moodle +1
Name of the Vulnerable Software and Affected Versions: Moodle versions 3.9 through 3.9.2 Description: The issue allowed including JavaScript when re-naming content bank items. This is fixed in Moodle versions 3.9.3 and 3.10. Recommendations: For versions 3.9 through 3.9.2, update to version 3.9.3...
Apple iOS Lock Screen Vulnerability
Apple iOS is an operating system for mobile devices developed by Apple Inc. in the United States. A security vulnerability exists in Apple iOS versions prior to 12.1.1, which stems from a lock screen issue that allows access to shared features on locked devices. An attacker could exploit the...
Emby Server Cross-Site Request Forgery Vulnerability
Emby Server is a personal media server software that supports storing, managing, and streaming personal media content with support for multiple device access. Emby Server suffers from a cross-site request forgery vulnerability that allows an attacker to use SSRF via the ImageURL parameter of...
CVE-2020-26948: Server-Side Request Forgery (SSRF)
Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...
Cyber Security Month. What can you do?
October is Cyber Security Month, when organisations like the CISA, the ECSM, and many more promote initiatives to help raise security awareness. Around the world companies are dedicating time to improve staff security awareness, and its a really busy time for us. You may be thinking you’d like to...
Sql injection
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
CVE-2020-17463
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
CVE-2020-13483
The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...
CVE-2020-13483: Improper Neutralization of Input During Web Page Generation
The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...
PT-2020-2849 · Microsoft · Sharepoint Server +1
Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: A cross-site-scripting XSS issue exists due to improper sanitization of specially crafted web requests. An authenticated attacker could exploit this by sending a special...
CVE-2020-7456: Improper Restriction of Operations within the Bounds of a Memory Buffer
In FreeBSD 12.1-STABLE before r361918, 12.1-RELEASE before p6, 11.4-STABLE before r361919, 11.3-RELEASE before p10, and 11.4-RC2 before p1, an invalid memory location may be used for HID items if the push/pop level is not restored within the processing of that HID item allowing an attacker with...
FreeBSD : cacti -- XSS exposure (cd864f1a-8e5a-11ea-b5b4-641c67a117d8)
Cacti developer reports : Lack of escaping of color items can lead to XSS exposure. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors Redistribution and use ...
CVE-2020-5866
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments...
CVE-2020-5866
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments...
Command injection
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments...