Phpgurukul User Registration v2.0 - Multiple Vulnerabilities

Document Title: =============== Phpgurukul User Registration v2.0 - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2216 Release Date: ============= 2020-04-19 Vulnerability Laboratory ID VL-ID:...

TAO Open Source Assessment Platform 3.3.0 RC02 Cross Site Scripting

Document Title: =============== TAO Open Source Assessment Platform v3.3.0 RC02 - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2215 Release Date: ============= 2020-04-16 Vulnerability Laboratory ID VL-ID:...

jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider

A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Time for Reflection and Thanks

Most of the programs I ran used calendar years for project planning, budgets, etc. I always found November to be a good time to reflect on the progress made, plan for the next year, and give thanks for all the positive steps in the right direction. In general, I followed the SWOTT method for...

EulerOS Virtualization 3.0.2.2 : perl (EulerOS-SA-2020-1476)

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-depende...

DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting Vendor Link: http://www.dedecms.com Software Link: http://www.dedecms.com/products/dedecms/downloads/ CVE: N/A Document Title: =============== DedeCMS v7.5 SP2 - Multiple Persistent Web...

CVE-2020-3194

A vulnerability in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording...

XSS injection in the Grid component of Sylius

Grid component of Sylius omits HTML input sanitisation while rendering object implementing toString method through the string field type...

GHSA-RC5R-697F-28X6 XSS injection in the Grid component of Sylius

Grid component of Sylius omits HTML input sanitisation while rendering object implementing toString method through the string field type...

CVE-2020-2805

A flaw was found in the way the readObject method of the MethodType class in the Libraries component of OpenJDK checked argument types. This flaw allows an untrusted Java application or applet to bypass Java sandbox restrictions...

CVE-2018-10865

It has been discovered that redhat-certification does not perform an authorization check and allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system. An attacker could use this flaw to send requests to port 8009 of any host or to keep restarting the...

vulhub

It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability class/vector is not explicitly stated, but the environments are designed to demonstrate various types of vulnerabilities. The probable entry points are the docker-compose files, which define the...

Description of the security update for Office 2013: April 14, 2020

Description of the security update for Office 2013: April 14, 2020 Summary This security update resolves a remote code execution vulnerability that exists if Microsoft Office incorrectly loads arbitrary type libraries. To learn more about the vulnerability, see Microsoft Common Vulnerabilities an...

WSO2 3.1.0 - Arbitrary File Delete

Title: WSO2 3.1.0 - Arbitrary File Delete Date: 2020-04-12 Author: raki ben hamouda Vendor: https://apim.docs.wso2.com Softwrare link: https://apim.docs.wso2.com/en/latest/ CVE: N/A Document Title: =============== WOS2 API ManagerDelete Extension Arbitrary File DeletePath traversal CVE not assign...

WSO2 API Manager Carbon Interface 3.0.0 File Delete

Document Title: =============== WOS2 API ManagerDelete Extension Arbitrary File DeletePath traversal CVE not assigned yet Author : Raki Ben Hamouda Security Update : https://apim.docs.wso2.com/en/latest/ Common Vulnerability Scoring System: ==================================== 8.5 Affected...

openSUSE: Security Advisory for gmp, (openSUSE-SU-2020:0501-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Directory traversal

An issue was discovered on Samsung mobile devices with KK4.4 and later software through 2015-06-16. In some cases, HTTP is used for an Inputmethod, rather than HTTPS. A man-in-the-middle attacker can modify the client-server data stream to insert directory traversal sequences into an extracted fi...

Information Disclosure

java is vulnerable to information disclosure. The vulnerability exists as an information leak was found in the way the TimeZone.getTimeZone method was handled. This method could load time zone files that are outside of the JREHOME/lib/zi/ directory, allowing a remote attacker to probe the local...

Same-Origin Policy Bypass

firefox is vulnerable to same-origin-policy bypass. A flaw was found in the way Firefox handled the addEventListener JavaScript method. A malicious web site could use this method to access or modify sensitive data from another web site...

Firefox Thunderbird Confidential Data Access Data Compromise

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to a method call error in two identical documents. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...