Php_Code_Analysis - San your PHP code for vulnerabilities

This script willscan your code the script can find 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection features 1. fast 2. simple report usage: python code.py this will scan one file python code.py...

Getting a persistent shell on a 747 IFE

TL:DR The Coronavirus pandemic has hit the airline industry hard. One sad consequence was early retirement of most of the 747 passenger fleet. This does however create opportunities for aviation security research, as airframes are parked up before parting out in breakers yards. This 747 was flyin...

openSUSE Security Update : sudo (openSUSE-2021-602)

This update for sudo fixes the following issues : - L3: Tenable Scan reports sudo is vulnerable to CVE-2021-3156 bsc1183936 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Bitdefender Endpoint Security Tool 安全漏洞

Bitdefender Endpoint Security Tool is an endpoint security management tool from the Romanian company Bitdefender. A security vulnerability exists in versions prior to Bitdefender Endpoint Security Tools 6.6.23.320, which stems from the presence of improper access control that allows a normal user...

Brocade Fabric OS 资源管理错误漏洞

Brocade Fabric OS FOS is an embedded operating system used in switches and routers and other devices from Brocade, U.S.A. A security vulnerability exists in Brocade Fabric OS that could be exploited by an attacker to trigger a fatal error via a security scan of Brocade Fabric OS to trigger a Deni...

PT-2021-3989 · WordPress · Rsvpmaker

Name of the Vulnerable Software and Affected Versions: RSVPMaker WordPress plugin versions prior to 8.7.3 Description: The issue is related to the Import feature of the RSVPMaker WordPress plugin, specifically with the "/wp-admin/tools.php?page=rsvpmaker export screen" endpoint. It is caused by...

CVE-2021-28649

An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a...

PT-2024-11113 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak has been identified in the Linux kernel, specifically in the trusted key module. The issue arises from two error return paths that fail to free the allocated object td,...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

Hardcoded credentials

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

PT-2024-11092 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak has been identified in the Linux kernel's ACPI scan functionality. The issue arises when the acpi device set name function fails, resulting in a potential memory leak if...

BSA-2021-1496

Security Advisory ID : BSA-2021-1496 Component : config and secnotify processes Revision : 1.0 Running security scans against the SAN switch can cause config and secnotify processes within the firmware before Brocade Fabric OS v9.0.0, v8.2.2d and v8.2.1e to consume all memory leading to denial of...

Packed.Win32.Black.d Unauthenticated Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/17e3836682ffb0913459ece7c3f0786d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Packed.Win32.Black.d Vulnerability: Unauthenticated Open Proxy Description: The malware listens on T...

SUSE SLES12 Security Update : sudo (SUSE-SU-2021:1273-1)

This update for sudo fixes the following issues : L3: Tenable Scan reports sudo is vulnerable to CVE-2021-3156 bsc1183936 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and...

How to scan and encrypt objects in S3 buckets

This article explains how to scan objects in S3 buckets against malware and keep your objects encrypted with SSE-KMS...

NitroRansomware Asks for $9.99 Discord Gift Codes, Steals Access Tokens

The NitroRansomware malware strain is shaking up the ransomware norm by demanding Discord Nitro gift codes from victims instead of actual money. Discord is a VoIP, instant messaging and digital-distribution platform designed for creating communities. Users communicate with voice calls, video call...

PentestBro - Combines Subdomain Scans, Whois, Port Scanning, Banner Grabbing And Web Enumeration Into One Tool

Experimental tool for Windows. PentestBro combines subdomain scans, whois, port scanning, banner grabbing and web enumeration into one tool. Uses subdomain list of SecLists. Uses nmap service probes for banner grabbing. Uses list of paths for web enumeration. Examplescan of "www.ccc.de": Scanned...

CVE-2021-25253

An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to...

CVE-2021-28645

An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target...