U.S. Dept Of Defense: Default Admin Username and Password on █████ Server at █████████mil

Description: A ██████ Server is running at https://███mil you can access the login at https://████mil/█████████ the application is using the default "Administrator for the default organization" credentials POC Go to https://███mil/████████ and login with █████ ██████████ ████ ████ How to remediat...

SQL Injection Vulnerability in CloudLock Server-Side Windows Version

CloudLock is a free server security management software based on operating system kernel hardening technology, which supports cross-platform real-time, batch and remote security management of windows/linux servers. SQL injection vulnerability exists in the Windows version of CloudLock server...

GHSA-GRV5-W5VR-8H98 Path Traversal in droppy

This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server...

Cross-site Scripting (XSS) - Reflected in coppermine-gallery/cpg1.6.x

✍️ Description Coppermine is vulnerable to XSS attacks on /plugins/uploadh5a/help.php because it doesnt sanitize user supplied parameters as shown below. Vulnerable variable: t Method: GET The $styles variable is constructed using the user supplied data, and then is echo in the response. $styles =...

SQL Injection Vulnerability in File Server Configuration Management System of UFIDA Network Technology Co.

Founded in 1988, UFIDA is a global provider of advanced cloud services, software, and financial services for enterprises and public organizations. A SQL injection vulnerability exists in the File Server Configuration Management System of UFIDA Network Technology Co., Ltd. that can be exploited by...

File upload vulnerability at hybbs 2.3.2 template

hybbs is a PHP web program that supports plugin extensions and template extensions. A file upload vulnerability exists in the hybbs 2.3.2 template, which can be exploited by an attacker to gain control of the web server...

SUSE: Security Advisory (SUSE-SU-2017:1705-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-29430

CVE-2021-29430 affects Sydent, the Matrix identity server. The issue allows memory exhaustion/DoS because HTTP requests can have unbounded body sizes and responses from remote homeservers can be very large. The vulnerability impacts servers handling untrusted registration requests. Patched releas...

DLA-2627-1 xorg-server - security update

Bulletin has no description...

MTN Group: Remote code execution due to unvalidated file upload

Summary: Hello I found a critical vunerability in one of your site, where user can upload any file type as a profile picture including php file Steps To Reproduce: 1. Visit https://careers.mtn.cm and register as a user. 2. After successful registration, login and update your data. 3. When uploadi...

CVE-2020-24137

CVE-2020-24137 affects WCMS 0.3.2. The vulnerability is a directory traversal in the wex/cssjs.php script, exploitable via the path parameter to read arbitrary files on the server. The connected Red Hat, CNVD, NVD, OSV, and CVE records corroborate the same issue. Exploit specifics and fixes are n...

vulhub2

This repository is an open-source collection of pre-built vulnerable docker environments, referred to as 'Vulhub'. It is an offensive tool for various areas, including web application security, web server security, and more. The primary purpose of Vulhub is to provide a simple and easy-to-use...

SUSE-SU-2021:0713-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - move logrotate options into specific parts for each log as 'global' options will persist past and clobber global options in the main logrotate config bsc1180525...

CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability

...

Microsoft brings advanced hardware security to Server and Edge with Secured-core

A cursory look at recent headlines reveals two clear trends. First, organizations around the world are embracing digital transformation using technologies across cloud and edge computing to better serve their customers and thrive in fast-paced environments. Second, attackers are constantly...

Weak password vulnerability in the oter4 management system

Alibaba B2B company, because of the characteristics of the business, the seller is mainly concentrated in the country, the buyer is mainly concentrated in foreign countries, so derived from Hangzhou and the United States of America, the demand for remote server room, and at the same time in order...

File Upload Vulnerability in the Cloud Platform of Teaching Video Application of Guangzhou Aoweiya Electronic Technology Co.

Teaching video application cloud platform is based on the background of the current educational video resources construction and user demand research, developed to adapt to the development of the times and meet the needs of the school, with the effectiveness, multi-functional, distinctive feature...

CVE-2020-13697

NanoHTTPD (RouterNanoHTTPD.java, GeneralHandler) through version 2.3.1 is vulnerable to reflected XSS because the GET handler prints unsanitized query-string input into an HTML page. Multiple sources (NVD, CVE-2020-13697 records; Veracode and GHSA advisories; OSV/CVE records) describe this XSS is...

CVE-2021-3120

CVE-2021-3120 affects the WordPress plugin YITH WooCommerce Gift Cards Premium (versions prior to 3.3.1). The vulnerability is an arbitrary file upload leading to RCE , triggered when a valid Gift Card product is added to the cart and the parameter ywgc-upload-picture accepts a PHP file, storing ...

Web shell attacks continue to rise

One year ago, we reported the steady increase in the use of web shells in attacks worldwide. The latest Microsoft 365 Defender data shows that this trend not only continued, it accelerated: every month from August 2020 to January 2021, we registered an average of 140,000 encounters of these threa...