SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:4067-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4067-1 advisory. - Version update to 7.2.34 jscSLE-23639 - CVE-2022-37454: Fixed SHA-3 buffer overflow bsc1204577. - Fix integer...

EUVD-2016-8332

In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution...

Ubuntu 16.04 ESM : PHP vulnerabilities (USN-5300-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5300-1 advisory. It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. CVE-2015-9253,...

Recommended update for php7 (moderate)

openSUSE Security Update: Recommended update for php7 Announcement ID: openSUSE-SU-2021:1570-1 Rating: moderate References: 1175508 1192050 1193041 Cross-References: CVE-2021-21703 CVE-2021-21707 CVSS scores: CVE-2021-21703 NVD : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 SUSE:...

CVE-2021-41273

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment...

Cross site request forgery (csrf)

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment...

CVE-2021-41176

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted...

CVE-2021-41176 logout CSRF in Pterodactyl Panel

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted...

File Upload Vulnerability in DedeCMSV6 6.0.3

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A file upload vulnerability exists in DedeCMSV6 6.0.3, which can be exploited by an attacker to gain control of the server...

Command Execution Vulnerability in DedeCMSV6 6.0.3

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A command execution vulnerability exists in DedeCMSV6 6.0.3, which can be exploited by an attacker to gain control of the server...

File Upload Vulnerability in DedeCMSV6

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A file upload vulnerability exists in DedeCMSV6, which can be exploited by an attacker to cause arbitrary code execution...

File upload vulnerability in DedeCMSV6 (CNVD-2021-25007)

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A file upload vulnerability exists in DedeCMSV6, which can be exploited by an attacker to cause arbitrary code execution...

File Upload Vulnerability in DedeCMSV6 Backend

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A file upload vulnerability exists in the DedeCMSV6 backend, which can be exploited by attackers to cause arbitrary code execution...

VM Backups <= 1.0 - CSRF to Database Backup Download

The plugin does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current theme. The files will be created in the uploads directory by default, with a timestamp in their filenames, without any access restriction,...

Logic Flaw Vulnerability in DEDECMSV6

DedeCMSV6 is based on PHP 7.x development, is scalable and fully open source. A logic flaw vulnerability exists in DEDECMSV6. An attacker can exploit the vulnerability to reset arbitrary user passwords...

LibreNMS 1.46 SQL Injection

Exploit Title: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection Google Dork: Unknown Date: 13-12-2020 Exploit Author: Hodorsec Vendor Homepage: https://www.librenms.org Software Link: https://github.com/librenms/librenms Update notice:...

LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection

Exploit Title: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection Google Dork: Unknown Date: 13-12-2020 Exploit Author: Hodorsec Vendor Homepage: https://www.librenms.org Software Link: https://github.com/librenms/librenms Update notice:...

Kali-Linux-Tools-Interface - Graphical Web Interface Developed To Facilitate The Use Of Security Information Tools

A graphical interface to use information security tools by the browser. Getting Started Kali Linux Tools Interface is a graphical interface to use information security tools by the browser. The project uses the Kali Linux tools as a reference because it is the distribution that has the largest...

CVE-2019-6977

gdImageColorMatch in gdcolormatch.c in the GD Graphics Library aka LibGD 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigg...

CVE-2020-7062 Null Pointer Dereference in PHP Session Upload Progress

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...