CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

I-Net Software Clear Reports 输入验证错误漏洞

I-net Software I-net software Clear Reports is a Java-based cross-platform reporting application from the German company I-net software I-net Software. The program supports the output of reports in PDF, HTML, PS and RTF formats. A security vulnerability exists in I-Net Software Clear Reports...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details...

DEBIAN-CVE-2021-23968

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox 86,...

CVE-2021-23969

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...

UBUNTU-CVE-2021-23969

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...

Mozilla: Content Security Policy violation report could have contained the destination of a redirect

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...

CVE-2021-27509

In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code...

CVE-2021-23340

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class bundles/AdminBundle/Controller/Reports/CustomReportController.php. An authenticated user can reach this function with a GET...

CVE-2021-23340

CVE-2021-23340 affects pimcore/pimcore pre-6.8.8 and is a Local File Inclusion in the downloadCsvAction of CustomReportController.php. An authenticated user can access /admin/reports/custom-report/download-csv?exportFile=[...] with an unsanitized exportFile parameter, enabling local file inclusio...

CVE-2021-27103

creationtimestamp| type| source ---|---|--- 2021-02-17 00:48:04+00:00| seen| https://t.me/cibsecurity/23688 2021-02-23 15:58:16+00:00| seen| MISP/7391b143-ed2a-4938-b1eb-1198b56048a3 2021-07-29 17:59:02+00:00| seen| https://t.me/RussianOSINT/875 2021-10-25 22:32:43+00:00| seen|...

North Korean Malicious Cyber Activity: AppleJeus

CISA, the Federal Bureau of Investigation, and the Department of the Treasury have released a Joint Cybersecurity Advisory and seven Malware Analysis Reports MARs on the North Korean government’s dissemination of malware that facilitates the theft of cryptocurrency—referred to by the U.S...

Sql injection

A SQL injection vulnerability in interface/reports/immunizationreport.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29140

OpenEMR is affected by CVE-2020-29140: a SQL injection in interface/reports/immunization_report.php susceptible to exploitation by a remote authenticated attacker via the form_code parameter. The issue affects OpenEMR prior to version 5.0.2.5. The vulnerability is due to improper handling of user...

A week in security (February 1 – February 7)

Last week on Malwarebytes Labs, we dug into a load of security events. We first peered into how Fonix ransomware was giving up the ghost, swearing off a life of crime and even apologizing for past actions. We looked at a credit card skimmer that found opportunity in the latest Magento 1 hacking...

CVE-2020-2507

creationtimestamp| type| source ---|---|--- 2021-02-03 18:49:18+00:00| seen| https://t.me/cibsecurity/23013 2024-12-19 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-12-19 2024-12-27 00:00:00+00:00| exploited| The Shadowserver...

USN-4720-2: Apport vulnerabilities

USN-4720-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Itai Greenhut discovered that Apport incorrectly parsed certain files in the /proc filesystem. A local attacker could use this issue to escalate...

Data Breach Exposes 1.6 Million Jobless Claims Filed in the Washington State

The Office of the Washington State Auditor SAO on Monday said it's investigating a security incident that resulted in the compromise of personal information of more than 1.6 million people who filed for unemployment claims in the state in 2020. The SAO blamed the breach on a software vulnerabilit...

Exploit for Improper Access Control in Elasticsearch

欢迎各位大佬提BUG,当前版本 AssetScanV1.3 周期 初版：2019年11月28日 V1.0初版编写完成 修改1：2019年12月02日 感谢Shadow·J反馈kali下文件导入异常 修改2：2019年12月03日 V1.1发布，新增ARP存活检测（回滚，测bug） 修改3：2019年12月04日 V1.2发布，修复漏洞脚本异常，修复weblogic脚本 修改4：2019年12月05日 V1.2修改，感谢sevck提供设计思路以及代码不规范问题 修改5：2019年12月05日 V1.2修改，修复IP数据处理异常 修改6：2019年12月19日...

SQL Injection Vulnerability in Cumulus Reports

Cumulus Reports is a free enterprise-grade WEB reporting tool. Cumulus Reports suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...