1072 matches found
PT-2018-10541
Name of the Vulnerable Software and Affected Versions radare2 version 2.5.0 Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based out-of-bounds read and application crash, via a crafted ELF file. This is due to a problem in the sh op function...
PT-2018-10534
Name of the Vulnerable Software and Affected Versions radare2 version 2.5.0 Description The issue concerns a denial of service caused by a heap-based out-of-bounds read and application crash. This can be triggered by remote attackers via a crafted binary file, specifically affecting the avr op...
Easy Hosting Control Panel Cross-Site Scripting Vulnerability (CNVD-2018-12711)
Easy Hosting Control Panel EHCP is an open source hosting control panel that is used to manage domains, emails, ftp users and more. A cross-site scripting vulnerability exists in EHCP version 0.37.12.b. The vulnerability stems from the program failing to properly validate user input. A remote...
CVE-2018-6361
Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account...
CVE-2018-6361
The CVE-2018-6361 entry affects Easy Hosting Control Panel (EHCP) v0.37.12.b. The connected sources describe a Cross-Site Scripting (XSS) vulnerability triggered through the op parameter, enabling an attacker to add a backdoor FTP account. The underlying issue is inadequate input validation/sanit...
PT-2018-17504
Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows for XSS via the op parameter. This can be exploited by adding a backdoor FTP account. Recommendations For Easy Hosting Control Panel EHCP version 0.37.12.b, avoid...
CVE-2018-6361: Improper Neutralization of Input During Web Page Generation
Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account...
Cross site request forgery (csrf)
An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...
CVE-2018-10503
An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...
PT-2018-9924
Name of the Vulnerable Software and Affected Versions: baijiacms V4 version v4 1 4 20170105 Description: An issue in index.php allows for CSRF attacks, enabling unauthorized actions such as adding an administrator account via "op=edituser", changing the administrator password via "op=changepwd", ...
CVE-2018-10503: Cross-Site Request Forgery (CSRF)
An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...
PT-2018-9782
Name of the Vulnerable Software and Affected Versions: baijiacms V3 Description: The issue allows for CSRF via the "index.php?mod=site&op=edituser&name=manager&do=user" API endpoint to add an administrator account. Recommendations: For baijiacms V3, as a temporary workaround, consider restricting...
PT-2018-9740
Name of the Vulnerable Software and Affected Versions: radare2 version 2.5.0 Description: The issue is a heap-based buffer over-read in the dalvik op function, located in libr/anal/p/anal dalvik.c. This can be exploited by remote attackers to cause a denial of service using a crafted DEX file...
PT-2018-9744
Name of the Vulnerable Software and Affected Versions: mruby versions prior to 1.4.1 Description: The issue is related to an integer overflow in the mrb vm exec function when handling OP GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. This could allow an attacker wh...
PT-2018-18634
Name of the Vulnerable Software and Affected Versions radare2 version 2.4.0 Description The issue is a heap-based buffer over-read in the dalvik op function of anal dalvik.c. This could allow remote attackers to cause a denial of service by providing a crafted dex file. Recommendations For radare...
Hackers made $3M on Jenkins server in one of biggest mining ops ever
By Waqas Another day, another Monero ming scam - This one, researchers This is a post from HackRead.com Read the original post: Hackers made $3M on Jenkins server in one of biggest mining ops ever...
Election Security
Good Washington Post op-ed on the need to use voter-verifiable paper ballots to secure elections, as well as risk-limiting audits...
Discuz! DiscuzX cross-site scripting vulnerability (CNVD-2018-02843)
Discuz! DiscuzX is an online forum system. A cross-site scripting vulnerability exists in Discuz! DiscuzX X3.4. A remote attacker can exploit this vulnerability by sending the 'op' parameter to the include\spacecp\spacecpupload.php file to inject arbitrary web script or HTML...
