6197 matches found
Design/Logic Flaw
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the...
CVE-2022-0377 LearnPress < 4.1.5 - Arbitrary Image Renaming
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the...
NotificationX < 2.3.12 - Unauthenticated SQLi
The plugin does not validate and escape the id parameter in its notificationx/v1/notification REST endpoint before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL Injection attacks. The apikey is the md5 of the homeurl either with http or https protocol...
Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM Security Network Intrusion Prevention System (CVE-2015-7575)
Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM Security Network Intrusion Prevention System. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a...
Backdoor.Win32.FTP.Ics Authentication Bypass / Code Execution
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18ac.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.FTP.Ics Vulnerability: Authentication Bypass Description: The malware runs an FTP...
Backdoor.Win32.FTP.Ics Remote Command Execution
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18acB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.FTP.Ics Vulnerability: Unauthenticated Remote Command Execution Description: The...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Control and Tivoli Storage Productivity Center October 2015 CPU and January 2016 CPU
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ Technology Edition that is shipped and used by IBM Spectrum Control and Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates in October...
CVE-2022-21800
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...
Design/Logic Flaw
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...
CVE-2022-21800 Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...
CVE-2022-21800
CVE-2022-21800 affects Airspan/MMP family: MMP <1.0.3, PTP C-series <2.8.6.1, PTMP C-series/A5x
[slackware-security] mozilla-thunderbird
New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-91.6.1-i686-1slack15.0.txz: Upgraded. This release contains security fixes and improvements. For mor...
CVE-2022-21800: Use of a Broken or Risky Cryptographic Algorithm
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed...
Trojan-Spy.Win32.Zbot.aawo.Zeus-Builder Insecure Permissions
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/fe0dacbc953d4301232b386fcb3afc23.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.Zbot.aawo.Zeus-Builder Vulnerability: Insecure Permissions Description: ZeuS Builde...
Backdoor.Win32.Zombam.b Cross Site Scripting
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/1e3665a67201209609ae493a2a590beeC.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.b Vulnerability: Cross Site Scripting XSS Description: z0mbie's HTTP RAT v0.1...
Backdoor.Win32.Freddy.2001 Authentication Bypass / Command Execution
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/434923afc32a7bc7355ed9a5224b9273.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Freddy.2001 Vulnerability: Authentication Bypass Command Execution Description: The...
Backdoor.Win32.Small.er Code Execution
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/9f11868c3beaa8e2c1f5c193f5888b85.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Small.er Vulnerability: Unauthenticated Remote Command Execution Description: The...
Backdoor.Win32.Wollf.m Weak Hardcoded Password
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/f375f6569e146e432e23589b8f112165.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Wollf.m Vulnerability: Weak Hardcoded Password Description: The malware runs with...
WordPress Learnpress 4.1.4.1 Arbitrary Image Renaming
Exploit Title: WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming Date: 08-01-2022 Exploit Author: Ceylan Bozogullarindan Author Webpage: https://bozogullarindan.com Vendor Homepage: https://thimpress.com/ Software Link: https://thimpress.com/learnpress-plugin/ Version: 4.1.4.1 Tested...
Backdoor.Win32.Small.bu Remote Command Execution
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/36ca28db068b6f6634d633fe61d34a7d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Small.bu KGB- RAT server v0.1 Vulnerability: Unauthenticated Remote Command Execution...