5647 matches found
CVE-2020-23996
A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data...
CVE-2020-23996
A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data...
Remote file inclusion
A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data...
CVE-2020-23996
CVE-2020-23996 affects the open‑source LMS ILIAS . Affected versions are before 5.3.19, 5.4.10, and 6.0, where a local file inclusion (LFI) vulnerability exists in the import of personal data. The issue can allow remote authenticated attackers to execute arbitrary code via the personal data impor...
CVE-2020-23996
A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data...
ILIAS 安全漏洞
Ilias is an open source learning management system for developing and implementing web-based e-learning. A local file inclusion vulnerability exists in Ilias versions prior to 5.3.19, 5.4.10, and 6.0. An attacker can exploit this vulnerability to execute arbitrary code by importing personal data...
Ransomware Gang Leaks Metropolitan Police Data After Failed Negotiations
The cybercrime syndicate behind Babuk ransomware has leaked more personal files belonging to the Metropolitan Police Department MPD after negotiations with the DC Police broke down, warning that they intend to publish all data if their ransom demands are not met. "The negotiations reached a dead...
Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63293)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA.Microsoft Windows is a set of operating systems for personal devices.Microsoft Windows Server is a set of server operating systems. An information disclosure vulnerability exists in the CSC service of...
Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-66097)
Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in the "Container Manager Service" of Microsoft...
Unison Desktop OS Personal Edition (1030) x86_64 is vulnerable to integer overflow
Unison Desktop OS Personal Edition is a home-grown desktop operating system built by Unison Software based on the Linux 5.3 kernel and launched specifically for personal users. An integer overflow vulnerability exists in Unisys Desktop OS Personal Edition 1030 x8664. An attacker can exploit the...
Teaching Cybersecurity to Children
A new draft of an Australian educational curriculum proposes teaching children as young as five cybersecurity: The proposed curriculum aims to teach five-year-old children -- an age at which Australian kids first attend school -- not to share information such as date of birth or full names with...
CVE-2021-32077
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number SSN values via a brute-force attack on a sometimes hidden search field, because the last four SSN digits are part of the supported combination of search...
CVE-2021-24249
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator export files, which could then be downloaded by the attacker to get access to PII, such as...
Cross site request forgery (csrf)
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator export files, which could then be downloaded by the attacker to get access to PII, such ...
Tour de Peloton: Exposed user data
An unauthenticated user could view sensitive information for all users, and snoop on live class statistics and its attendees, despite having a private mode. TL;DR Information disclosed included: - User IDs - Instructor IDs - Group Membership - Location - Workout stats - Gender and age - If they a...
Feds seize fraud domain claiming to provide COVID-19 vaccine
By Habiba Rashid The website was scamming users in the name of providing the COVID-19 vaccine but actually collecting their personal data for malicious purposes. This is a post from HackRead.com Read the original post: Feds seize fraud domain claiming to provide COVID-19 vaccine...
Spam and phishing in Q1 2021
Quarterly highlights Banking phishing: new version of an old scheme In Q1 2021, new banking scams appeared alongside ones that are more traditional. Clients of several Dutch banks faced a phishing attack using QR codes. The fraudsters invited the victim to scan a QR code in an email, ostensibly t...
Directory traversal
SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved o...
CVE-2020-4039
CVE-2020-4039 affects SUSI.AI Server prior to version d27ed0f, with a directory traversal flaw caused by insufficient input validation. An attacker can read any admin config and files readable by the app, and may also move or delete certain files. The issue originates from how untrusted input is ...