Code execution vulnerability in ejucms backend

EJU real estate system ejucms is a set of localized O2O real estate website platform system. Code execution vulnerabilities exist in the background of ejucms, attackers can exploit the vulnerability to execute malicious code to obtain server privileges...

Authorization Bypass Vulnerability in Configuration King Real-Time Database

Configuration King, i.e. Configuration King development monitoring system software, is a new type of industrial automatic control system, which replaces the traditional closed system with an integrated system composed of standard industrial computer software and hardware platforms. There is an...

RHEL 8 : kernel-rt (RHSA-2020:1567)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1567 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

WordPress Plugin Bug Opens 100K Websites to Compromise

A high-severity cross-site request forgery CSRF vulnerability in Real-Time Find and Replace, a WordPress plugin installed on more than 100,000 sites, could lead to cross-site scripting and the injection of malicious JavaScript anywhere on a victim site. According to research from Wordfence releas...

Simplifying Data Center and IaaS Visibility and Protection

Helping customers further secure their on-premises data centers and IaaS deployments is an interesting new use case for our Enterprise Threat Protector service. Enterprises typically have a significant number of applications that are deployed and run in these environments. I'm using the word...

Real-Time Find and Replace < 4.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

This flaw could allow any user to inject malicious Javascript anywhere on a site if they could trick a site’s administrator into performing an action, like clicking on a link in a comment or email...

Real-Time Find and Replace < 4.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

This flaw could allow any user to inject malicious Javascript anywhere on a site if they could trick a site’s administrator into performing an action, like clicking on a link in a comment or email. PoC...

The vulnerability in the implementation of the WebRTC protocol in Google Chrome browser allows a perpetrator to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the WebRTC protocol implementation in Google Chrome browser relates to the use of memory after deallocation. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to information and compromise its integrity and accessibility...

Malicious Package

Overview application-digester is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Oracle Real User Experience Insight (Apr 2020 CPU)

The version of Oracle Real User Experience Insight installed on the remote host is missing the April 2020 CPU. It is, therefore, affected by a buffer overflow condition due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by sending speciall...

Qualys Response to Rapid7’s False Claims on VMDR

As remote working is becoming the need of the hour, IT and Security teams are working tirelessly to ensure continuity of services and deliver on all aspects of the business. To help our customers in these challenging times, we launched a 60-day no-cost ‘Remote Endpoint Protection’ service for...

Residential Internet Connections are now Business Connections: What about Security and Compliance?

Near-global mandates to stay at home have completely reshaped the internet security landscape. Remote work is the new normal, inverting the traditional office model. Attackers are not relenting as they see opportunity to take advantage of a world with a singular focus. Here are a couple of recent...

The vulnerability of the configuration of HTTP proxy servers for WebKitGTK and WPE WebKit modules, which allow attackers to gain unauthorized access to protected information.

The vulnerability of the configuration of HTTP proxy servers for WebKitGTK and WPE WebKit modules related to improper data processing during real-time video loading. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

How to transform your revolutionary idea into a reality: $100K Nokia Bell Labs Prize

Revolutionary ideas in science, technology, engineering, and mathematics don't occur every day. But when those "eureka" moments happen, we need to provide a forum to explore those ideas, judge them on their merits, and distinguish the extraordinary from the merely good. Once a year, Nokia Bell La...

nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application compiled with nss. While the attack complexi...

UBUNTU-CVE-2020-6444

Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

MS15-081: Description of the security update for Word 2016: October 13, 2015

Resolves vulnerabilities in Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file.SummaryThis security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office...

Arbitrary Code Execution

mutt is vulnerable to arbitrary code execution. A flaw was found in the way Mutt handled certain characters in gecos fields which could lead to a buffer overflow. The gecos field is an entry in the password database typically used to record general information about the user. A local attacker cou...

Unauthorized Access Vulnerability in PoE Infrared Webcam of P&L Technologies Ltd.

hereinafter referred to as "TP-LINK" is a leading global supplier of network communication equipment. TP-LINK's PoE infrared webcam has an unauthorized access vulnerability, which can be exploited by attackers to directly steal real-time video streams by constructing usernames and passwords at...