Rapid7 Announces Partner of the Year Awards 2023 Winners

It’s with immense pleasure that we announce today the winners of the Rapid7 Partner of the Year Awards 2023. All our category winners have achieved exceptional growth—demonstrating their dedication to, and collaboration with, the Rapid7 Partner Program throughout the year. “We are incredibly...

SUSE-SU-2023:1698-1 Security update for sudo

This update for sudo fixes the following issue: Security fixes: - CVE-2023-28486: Fixed missing control characters escaping in log messages bsc1209362. - CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output bsc1209361. Other fixes: - Fix a situation where 'sudo -U...

SUSE-SU-2023:1659-1 Security update for sudo

This update for sudo fixes the following issue: Security fixes: - CVE-2023-28486: Fixed missing control characters escaping in log messages bsc1209362. - CVE-2023-28487: Fixed missing control characters escaping in sudoreplay output bsc1209361. Other fixes: - Fix a situation where 'sudo -U...

SUSE CVE-2005-0023

gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed...

CVE-2022-43271

Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting XSS vulnerability via the User profile component...

Cross site scripting

Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting XSS vulnerability via the User profile component...

CVE-2022-43271

CVE-2022-43271 affects Inhabit Systems Move CRM version 4, build 260, with a cross-site scripting (XSS) vulnerability via the User profile component. Public details in the provided documents confirm the issue exists and indicate a CVSS v3.1 base score of 5.4 (MEDIUM) with network attack vector, l...

CVE-2022-3059 SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

The application was vulnerable to multiple instances of SQL injection authenticated and unauthenticated through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL...

CVE-2022-39020 Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

Multiple instances of XSS stored and reflected was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting...

Amazon Linux 2 : golang-github-kr-pty (ALAS-2022-1864)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1864 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A flaw was found in golang. The HTTP/1 client accepted invalid...

Linux kernel 竞争条件问题漏洞

The Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a memory corruption that can be triggered in the Linux kernel via ptyunthrottle, which can be exploited ...

deno (>=0.35.0, <=1.3.0), diss (>=0.0.1, <=0.2.10) +8 more potentially affected by unknown CVE via pty (>=0.1.6, <=0.2.2)

pty CARGO version =0.1.6, =0.35.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.0, =0.1.0 - webterm-rs 0.1.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0015...

RUSTSEC-2022-0015 pty is unmaintained

The repository hasn't received any updates since Jun 25, 2017 and the author is unresponsive. Maintained alternatives include: tokio-pty-process pty-process...

CVE-2022-25570

In Click Studios SA Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder with the default permission model can extend his...

CVE-2022-25570

Technical details (versions, root cause, impact, and fixes) are not publicly provided in the connected documents; monitor for updates.

Magic Mouse 2 utilities 2.20 - (magicmouse2service) Unquoted Service Path Vulnerability

Exploit Title: Magic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service Path Exploit Author : SamAlucard Vendor : Magic Utilities Pty Version : 64-bit 2.20 Vendor Homepage : https://magicutilities.net/magic-mouse/home Tested on OS: Windows 10 Home Analyze PoC : ============== C:\sc qc...

Enigma NMS 65.0.0 SQL Injection

-------------------------------------------------------------------- Exploit Title: Enigma NMS searchpattern SQL Injection Date: 21 July 2019 Author: Mark Cross @xerubus | mogozobo.com Vendor: NETSAS Pty Ltd Vendor Homepage: https://www.netsas.com.au/ Software Link:...

Enigma NMS 65.0.0 - Cross-Site Request Forgery

-------------------------------------------------------------------- Exploit Title: Enigma NMS Cross-Site Request Forgery CSRF Date: 21 July 2019 Author: Mark Cross @xerubus | mogozobo.com Vendor: NETSAS Pty Ltd Vendor Homepage: https://www.netsas.com.au/ Software Link:...

Enigma NMS 65.0.0 - OS Command Injection

!/usr/bin/python -------------------------------------------------------------------- Exploit Title: Enigma NMS OS Command Injection NETSAS Pty Ltd Enigma NMS Date: 21 July 2019 Author: Mark Cross @xerubus | mogozobo.com Vendor: NETSAS Pty Ltd Vendor Homepage: https://www.netsas.com.au/ Software...

Enigma NMS 65.0.0 - Cross-Site Request Forgery Exploit

Exploit for multiple platform in category web applications -------------------------------------------------------------------- Exploit Title: Enigma NMS Cross-Site Request Forgery CSRF Author: Mark Cross @xerubus | mogozobo.com Vendor: NETSAS Pty Ltd Vendor Homepage: https://www.netsas.com.au/...