HashiCorp Consul and Consul Enterprise 跨站脚本漏洞

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and provision applications across a dynamically distributed infrastructure. A security vulnerability exists in HashiCorp Consul and Consu...

Cross-site Request Forgery (CSRF)

Amendment This issue was found to be a duplicate. The original vulnerability with details can be found here...

Sutou Kouhei rexml 安全漏洞

Sutou Kouhei rexml is a Sutou Kouhei open source application . Support for tree and stream document parsing . REXML security vulnerability , the vulnerability stems from parsing and serializing a carefully crafted XML document , may create a structure different from the original document with the...

[SECURITY] Fedora 33 Update: gdk-pixbuf2-xlib-2.40.2-2.fc33

gdk-pixbuf2-xlib contains the deprecated API for integrating gdk-pixbuf2 wi th Xlib data types. This library was originally shipped by gdk-pixbuf2, and has since been moved out of the original repository. No newly written code should ever use this library. If your existing code depends on...

KLA12048 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Media can...

Raonwiz DEXT5 Path Traversal Vulnerability

Raonwiz DEXT5 is a set of HTML5-based file transfer solution from Raonwiz Korea. The product supports encrypted file transfer, form building, etc. DEXT5Upload is one of the file upload components. A path traversal vulnerability exists in DEXT5Upload version 2.7.1262310 and earlier versions, which...

Hackers hiding skimming malware behind social media sharing icons

By Sudais Asif According to researchers, the malware hides behind icons from top networks such as Facebook, Instagram, Twitter, Google, YouTube, and Pinterest. This is a post from HackRead.com Read the original post: Hackers hiding skimming malware behind social media sharing icons...

Enum4Linux-Ng - A Next Generation Version Of Enum4Linux (A Windows/Samba Enumeration Tool) With Additional Features Like JSON/YAML Export

enum4linux-ng.py is a rewrite of Mark Lowe's former Portcullis Labs now Cisco CX Security Labs enum4linux.pl, a tool for enumerating information from Windows and Samba systems, aimed for security professionals and CTF players. The tool is mainly a wrapper around the Samba tools nmblookup, net,...

Use-after-free when cloning a partially consumed `Vec` iterator

The IntoIter Clone implementation clones the whole underlying Vec. If the iterator is partially consumed the consumed items will be copied, thus creating a use-after-free access. A proof of concept is available in the original bug report...

RUSTSEC-2020-0145 Use-after-free when cloning a partially consumed `Vec` iterator

The IntoIter Clone implementation clones the whole underlying Vec. If the iterator is partially consumed the consumed items will be copied, thus creating a use-after-free access. A proof of concept is available in the original bug report...

WordPress < 5.5.2 - Unauthenticated DoS Attack to RCE

Description The release notes state: "Props to Omar Ganiev who reported a method where a DoS attack could lead to RCE." The attack consisted of creating a DoS condition on the MySQL database, which would make WordPress think that it has not been installed, presenting the installation wizard. The...

Slow Response to the Client Requests when USIP Mode is Enabled on ADC

When using ADC inUse Source IP USIP mode, a slow response to the client requests is experienced. Servers had requests in surge queues that were not processed. Background The USIP mode enables the NetScaler appliance to communicate with the backend servers by using the original Client IP address a...

SQL Injection Vulnerability in Shield Spirit Original Article Submission System 1.0

Shield Spirit Original Article Submission System 1.0 is a concise submission system. Shield Spirit Original Article Submission System 1.0 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in the background up***.php file of Shield Spirit Original Article Submission System

The Shield Spirit Original Article Submission System is a concise submission system. A SQL injection vulnerability exists in the background up.php file of Shield Spirit Original Article Submission System. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Storage-based Cross-site Scripting Vulnerability in NetCloud Original Novel PC System

Ltd. is the pioneer of professional net article all-platform technology service. A storage-based cross-site scripting vulnerability exists in the NetCloud Original Novel PC system. Attackers can utilize the vulnerability to obtain sensitive information such as user cookies...

Mozilla: Download origin spoofing via redirect

The Mozilla Foundation Security Advisory describes this flaw as: By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site the one suffering from the open redirect rather than the site the fil...

Microsoft Windows XP Source Code Reportedly Leaked Online

Microsoft's long-lived operating system Windows XP—that still powers over 1% of all laptops and desktop computers worldwide—has had its source code leaked online, allegedly, along with Windows Server 2003. Yes, you heard that right. The source code for Microsoft's 19-year-old operating system was...

Mozilla: Download origin spoofing via redirect

The Mozilla Foundation Security Advisory describes this flaw as: By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site the one suffering from the open redirect rather than the site the fil...

Mozilla: Download origin spoofing via redirect

The Mozilla Foundation Security Advisory describes this flaw as: By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site the one suffering from the open redirect rather than the site the fil...

UBUNTU-CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...