Server-Side Request Forgery (SSRF)

ftp-srv is vulnerable to server-side request forgery. A remote client is able to submit requests on behalf of the server and access resources within the internal network accessible by the server, including private resources in the hosting environment...

Fancy Lightbox < 1.0.2 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking a remote resource Image, Video or web page from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used...

DAGOBAH - Open Source Tool To Generate Internal Threat Intelligence, Inventory & Compliance Data From AWS Resources

Dagobah is an open source tool written in python to automate the internal threat intelligence generation, inventory collection and compliance check from different AWS resources. Dagobah collects information and save the state into an elasticsearch index. Dagobah runs into the a LAMBDA and looks a...

The vulnerability of the Libvirt virtualization management library lies in the improper assignment of permissions to critical resources, allowing attackers to increase their privileges.

The vulnerability of the Libvirt virtualization management library is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

Artifex Software Artifex MuJS Resource Management Error Vulnerability

Artifex Software Artifex MuJS is a lightweight JavaScript interpreter from Artifex Software that is used to embed into other software to provide script execution capabilities. A resource management error vulnerability exists in the jsrun.c file in Artifex Software Artifex MuJS 1.0.7 and earlier...

The vulnerability of the parse_report() function in the whoopsie error logging service allows a violator to trigger a service failure.

The vulnerability of the parsereport function in the whoopsie error reporting service is related to unlimited resource distribution. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the GlobalProtect for Windows security software suite arises from insufficient checks on the status of shared resources. This allows attackers to execute programs with SYSTEM privileges.

The vulnerability of the GlobalProtect for Windows endpoint protection software exists due to insufficient testing of the state of the shared resources. Exploiting this vulnerability allows an attacker to execute programs with SYSTEM privileges...

CVE-2020-15597

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field...

Cross site scripting

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field...

CVE-2020-15597

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field...

bidq.co.kr Cross Site Scripting vulnerability OBB-1256348

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

powermetalresources.com Cross Site Scripting vulnerability OBB-1252458

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Information Disclosure

squid is vulnerable to information disclosure. Due to incorrect input validation, the application interprets malicious HTTP requests in unexpected ways to access server resources prohibited by earlier security filters...

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows...

Xxe

IBM UrbanCode Deploy UCD 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181848...

Security Bulletin: CVE-2009-2625 CVE-2012-0881 CVE-2013-4002 CVE-2014-0107 Multiple Xml handling Issues in xerces and xalan

Summary CVE-2009-2625 CVE-2012-0881 CVE-2013-4002 CVE-2014-0107 Multiple Xml handling Issues in xerces and xalan Vulnerability Details CVEID: CVE-2009-2625 DESCRIPTION: Sun Java Runtime Environment JRE is vulnerable to a denial of service, caused by an error in Apache Xerces2 Java. A remote...

Lock and Code S1Ep12: Pinpointing identity and access management’s future with Chuck Brooks

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Chuck Brooks, cybersecurity evangelist and adjunct professor for Georgetown University’s Applied Intelligence Program and graduate Cybersecurity Programs...

CVE-2020-4377

IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 179156...

Updated botan2 packages fix security vulnerability

The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length...

Xxe

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484...