Moodle 访问控制错误漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from an access control error vulnerability that stems from the fact that if the Upload Course tool is used to delete an...

Microsoft Azure Sphere Denial of Service Vulnerability

Azure Sphere is a secure, advanced application platform with built-in communications and security features for connected devices. A security vulnerability exists in Microsoft Azure Sphere that allows an attacker to trigger a denial of service by exploiting the vulnerability...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

CVE-2017-7921 Hikvision has no authorization to perform POC...

Medium: ibus

Issue Overview: A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the...

SUSE-SU-2020:3262-1 Security update for python3

This update for python3 fixes the following issues: - bsc1177211 CVE-2020-26116 no longer allowing special characters in the method parameter of HTTPConnection.putrequest in httplib, stopping injection of headers...

openSUSE Security Update : python (openSUSE-2020-1859)

This update for python fixes the following issues : - bsc1177211 CVE-2020-26116 no longer allowing special characters in the method parameter of HTTPConnection.putrequest in httplib, stopping injection of headers. This update was imported from the SUSE:SLE-15:Update update project. C Tenable...

PT-2020-16163 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.5 to 3.5.14 Moodle versions 3.7 to 3.7.8 Moodle versions 3.8 to 3.8.5 Moodle versions 3.9 to 3.9.2 Description: The upload course tool in Moodle contains an issue where deleting a non-existent or disabled enrollment method...

Security update for python (moderate)

openSUSE Security Update: Security update for python Announcement ID: openSUSE-SU-2020:1859-1 Rating: moderate References: 1177211 Cross-References: CVE-2020-26116 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for python...

OPENSUSE-SU-2020:1859-1 Security update for python

This update for python fixes the following issues: - bsc1177211 CVE-2020-26116 no longer allowing special characters in the method parameter of HTTPConnection.putrequest in httplib, stopping injection of headers. This update was imported from the SUSE:SLE-15:Update update project...

GWTMap - Tool to help map the attack surface of Google Web Toolkit

GWTMap is a tool to help map the attack surface of Google Web Toolkit GWT based applications. The purpose of this tool is to facilitate the extraction of any service method endpoints buried within a modern GWT application's obfuscated client-side code, and attempt to generate example GWT-RPC...

VulnCheck KEV: CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method...

CVE-2020-27688

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The...

CVE-2020-27688

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The...

Design/Logic Flaw

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The...

CVE-2020-27688

RVTools 4.0.6 is affected by CVE-2020-27688: RVToolsPasswordEncryption.exe uses a static IV and key for encryption, and the Decrypt() method in VISKD.cs within RVTools.exe can decrypt the stored passwords. This creates a risk that passwords in configuration files could be recovered by anyone with...

GHSA-P694-23Q3-RVRC Remote Code Execution in Apache Synapse

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

EulerOS 2.0 SP9 : python3 (EulerOS-SA-2020-2437)

According to the version of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker...

Joomla Publisher 3.0.19 Cross Site Scripting

Exploit Title: Joomla Publisher V 3.0.19 Stored XSS Date: 03.11.2020 Author: Vincent666 ibn Winnie Software Link: https://publisher.ijoomla.com/demo Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest.vincent.blogspot.com/ PoC:...

SUSE-SU-2020:3121-1 Security update for python

This update for python fixes the following issues: - CVE-2020-26116: Fixed CRLF injection via HTTP request method bsc1177211...

EulerOS 2.0 SP8 : libX11 (EulerOS-SA-2020-2313)

According to the versions of the libX11 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow leading to a heap-buffer overflow was found in The X Input Method XIM client was implemented in libX11 before version 1.6.10...