PT-2021-27636

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap buffer overflow read, as indicated by the crash type. The crash state involves several functions: encode LEARN, ofpacts pu...

Open Source Matters Joomla 跨站脚本漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! 3.9.0 - 3.9.23. The...

PT-2021-3367

Name of the Vulnerable Software and Affected Versions LibrIT PaSSHport versions 2.5 and earlier Description The issue exists due to the lack of measures to neutralize special elements in LDAP requests, allowing for LDAP injection. This can be exploited by a remote attacker to gain unauthorized...

PT-2020-17364 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.22 Description: An issue was discovered in the folder parameter of mod random image, which lacked input validation, leading to a path traversal vulnerability. Recommendations: For Joomla! versions 2.5.0...

Joomla! 路径遍历漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A path traversal vulnerability exists in Joomla! 2.5.0 - 3.9.22. The vulnerabilit...

CVE-2020-28184

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

PT-2020-16939

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to "/module/index.php" API endpoint. This enables attackers to execute malicious...

CVE-2020-28184: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

CVE-2020-13969

CRK Business Platform = 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter. This is path-independent...

CVE-2020-13969: Improper Neutralization of Input During Web Page Generation

CRK Business Platform = 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter. This is path-independent...

PT-2020-13807

Name of the Vulnerable Software and Affected Versions CRK Business Platform versions = 2019.1 Description The issue allows reflected XSS via the erro.aspx page, specifically through the CRK, IDContratante, Erro, or Mod parameters. This vulnerability is path-independent. Recommendations For CRK...

PT-2020-22815

Name of the Vulnerable Software and Affected Versions mbedTLS affected versions not specified Description The issue concerns several security-related problems. One problem is related to the size of calculations performed by mbedtls mpi exp mod, which could lead to a potential denial of service wh...

CVE-2020-19165

PHPSHE 1.7 is affected by CVE-2020-19165: an SQL injection in the admin.php?mod=user&userlevel_id=1 and userlevel_id[] parameter. The issue originates from unsafely handling userlevel_id input, enabling an attacker to manipulate SQL queries. No remediation details are provided in the connected do...

PT-2020-15170

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection via the "admin.php?mod=user&userlevel id=1" API endpoint, specifically through the userlevel id parameter. This allows for potential exploitation. Recommendations For PHPSHE...

A week in security (November 23 – November 29)

Last week on Malwarebytes Labs, we talked with Chris Boyd about charities that track you online. We also looked back at Zoom, and wondered whether its any safer months after its first vulnerability was reported. We talked about how Apples security is hampering the detection of potentially unwante...

Mongodb Server Input Validation Error Vulnerability (CNVD-2020-67315)

Mongodb Server is the United States Mongodb company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A security vulnerability exists in MongoDB Server that originates from the...

CVE-2019-2392

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prio...

Input validation

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prio...

UBUNTU-CVE-2019-2392

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prio...