CVE-2021-41248 XSS vulnerability in GraphiQL

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

WordPress Stylish Price List plugin access control error vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The WordPress Stylish Price List plugin is vulnerable to an access control error in versions prior to 6.9.0, which stems from the plugin's lack of user identity checking in its spluploadserimg AJAX...

BlackMatter ransomware gang is reportedly quitting operation

By Waqas BlackMatter ransomware gang, which is believed to be a rebrand of DarkSide, has decided to end the project, giving in to the pressures of the local law enforcement authorities. This is a post from HackRead.com Read the original post: BlackMatter ransomware gang is reportedly quitting...

Heap-based Buffer Overflow in zyantific/zydis

As discussed in the report at https://www.huntr.dev/bounties/96b0a482-7041-45b1-9327-c6a4a8f32d3a/, I am re-opening the report here for proper tracking. Description Hello, we hope you're doing well during these challenging times. Whilst testing zydis built from commit 077b185 with Clang12 + ASan ...

Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

Micro Focus Operation Bridge Report OBR contains an unspecified vulnerability that allows for remote code execution...

The vulnerability of the sm501_2d_operation function in the QEMU hardware emulation software, located in the sm501.c file, involves integer overflows, which allow attackers to compromise data integrity.

The vulnerability of the sm5012doperation function in the QEMU hardware emulation software, located in the sm501.c file, is related to integer overflows. Exploiting this vulnerability could allow an attacker to compromise data integrity...

International Operation Knocks Notorious REvil Group Offline

Plus: Data theft in Argentina, a Sinclair Broadcast Group hack, and more of the week’s top security news...

CVE-2020-36486

Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting XSS vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling...

ZTE MF971R Referer Authentication Bypass Vulnerability

The ZTE MF971R is a Cat 6 LTE mobile Wi-Fi router with download speeds up to 300mbps and upload speeds up to 50mbps.The ZTE MF971R is vulnerable to a Referer authentication bypass. An attacker can exploit the vulnerability by sending a click request to the user to perform an illegal authorized...

ZTE MF971R LTE router 授权问题漏洞

The ZTE MF971R is a Cat 6 LTE mobile Wi-Fi router with download speeds up to 300mbps and upload speeds up to 50mbps.The ZTE MF971R is vulnerable to a Referer authentication bypass. An attacker can exploit the vulnerability by sending a click request to the user to perform an illegal authorized...

CVE-2021-43305

Heap buffer overflow in ClickHouse’s LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopyop, ip, copyend , don’t exceed the destination buffer’s limits. This iss...

backstage 路径遍历漏洞

backstage is a software application. Backstage is an open platform for building developer portals Backstage suffers from a path traversal vulnerability that stems from the ability to read sensitive files from an environment running Scaffolder Tasks. The attack is executed by crafting a custom...

CVE-2021-3875

There's an out-of-bounds read flaw in Vim's exdocmd.c. An attacker who is capable of tricking a user into opening a specially crafted file could trigger an out-of-bounds read on a memmove operation, potentially causing an impact to application availability...

Google: We're Tracking 270 State-Sponsored Hacker Groups From Over 50 Countries

Google's Threat Analysis Group TAG on Thursday said it's tracking more than 270 government-backed threat actors from more than 50 countries, adding it has approximately sent 50,000 alerts of state-sponsored phishing or malware attempts to customers since the start of 2021. The warnings mark a 33%...

Cybozu Remote Service Operation Restriction Bypass Vulnerability

Cybozu Remote Service is a remote service management software used to access Cybozu's internal systems. a bypass vulnerability exists in the Cybozu Remote Service management interface. A remote authenticated attacker can use this vulnerability to change the data in the management interface...

CVE-2021-20831

Cross-site request forgery CSRF vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and unintended operation may be performed via unspecified vectors...

CVE-2021-20803

Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the management screen...

CVE-2021-20803

Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the management screen...

Design/Logic Flaw

Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the management screen...

CVE-2021-20831

Cross-site request forgery CSRF vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and unintended operation may be performed via unspecified vectors...