OESA-2024-1073 tidy security update

When editing HTML it's easy to make mistakes. Wouldn't it be nice if there was a simple way to fix these mistakes automatically and tidy up sloppy editing into nicely laid out markup? Well now there is! Dave Raggett's HTML TIDY is a free utility for doing just that. It also works great on the...

Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks

Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments. "This attack is particularly intriguing due to the attacker's use of packers and rootkits to conceal the malware," Aqua...

The vulnerability of the password-recovery.php script of the testing management system allows a hacker to execute arbitrary SQL queries against the database.

The vulnerability of the password-recovery.php script of the testing management system related to the PHPGurukul Nipah Virus Testing Management System lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL...

CVE-2023-51984

D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitrary commands via shell...

PT-2024-15037 · WordPress · The Greenshift

Name of the Vulnerable Software and Affected Versions: The Greenshift – animation and page builder blocks plugin for WordPress versions up to, and including, 7.6.2 Description: The issue is related to arbitrary file uploads due to missing file type validation on the gspb save files function. This...

The vulnerability of the Documents module in the ABO.CMS system allows a perpetrator to execute arbitrary code.

The vulnerability of the Documents module in the ABO.CMS system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Avalanche FileStoreConfig Arbitrary File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileStoreConfig app. The issue results from the lack of proper validation of...

The vulnerability of the WebKit component of the macOS operating system, allowing a hacker to execute arbitrary code

The vulnerability of the WebKit component of the macOS operating system relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created link...

CVE-2023-51123

An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in the soapcgimain function of the cgibin binary component...

CVE-2023-48257

The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution RCE with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticate...

[SECURITY] Fedora 38 Update: libssh-0.10.6-2.fc38

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, trans fer files, use a secure and transparent tunnel for your remote...

The vulnerability of the SpringBlade microservice development platform lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the SpringBlade microservice development platform lies in the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

DEBIAN-CVE-2024-21646

Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remo...

PT-2024-1022 · Microsoft · Odbc Driver +1

Name of the Vulnerable Software and Affected Versions: Microsoft ODBC Driver affected versions not specified Description: The issue is related to insufficient input validation in the ODBC driver of Windows operating systems. It allows a remote attacker to execute arbitrary code. Recommendations: ...

Sql injection

SQL Injection vulnerability in ABO.CMS v.5.9.3, allows remote attackers to execute arbitrary code via the d parameter in the Documents module...

The vulnerability of the OTCMS sales application, related to the failure to protect the SQL query structure, allows attackers to execute arbitrary code.

The vulnerability of the OTCMS sales application relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the protected information...

CVE-2023-41288

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 2023/11/23 and later...

CVE-2023-41288

CVE-2023-41288 is an OS command injection vulnerability affecting QNAP Video Station. Multiple connected sources confirm the flaw allows an attacker to execute commands over the network via Video Station’s interface. Impacted products/versions are Video Station prior to 5.7.2; the issue is addres...

QNAP Systems QcalAgent Operating System Command Injection Vulnerability

QNAP Systems QcalAgent is a time management center from QNAP Systems. It is used to manage personal schedules, share calendars with others, and share each other's schedules. A security vulnerability exists in QNAP Systems QcalAgent prior to version 1.1.8 that stems from the presence of an operati...

Sql injection

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'userid' parameter after the login portal...