3857 matches found
ASSURE Case Study: Two
The engagement The purpose of this exercise was to validate the clients’ baseline security assessment against NIS and the CAF and prepare them for the CAA Assure audit against NIS and CAF. There were 24 systems for the client and 9 third party systems. The client had carried out some initial...
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
✍️ Description There is svg tag filtration problem in "book page" egit leading to stored XSS. SVG images can be used on book pages, but there is not server side attribute filtration implemented for it. 🕵️♂️ Proof of Concept There is filter for href attribute, but inside SVG xlink:href used. That...
Out of bounds write in slice-deque
Affected versions of this crate entered a corrupted state if mem::sizeof:: % allocationgranularity != 0 and a specific allocation pattern was used: sufficiently shifting the deque elements over the mirrored page boundary. This allows an attacker that controls controls both element insertion and...
Cisco Nexus 9000 Series Fabric Switches 输入验证错误漏洞
The Cisco Nexus 9000 Series Fabric Switches is a 9000 series fiber optic switch from Cisco. An input validation error vulnerability exists in the Cisco Nexus 9000 Series Fabric Switches that stems from the product's mishandling of TCP traffic on a specific port. The vulnerability can be exploited...
CVE-2021-22357
There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages due to validating inputs insufficiently. Attackers can exploit this vulnerability by sending specific messages to affected module. This can cause denial of service. Affected product versions...
CVE-2021-22328
There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft the specific packet. Successful exploit may cause some services abnormal. Affected product versions include:CloudEngine 12800...
CVE-2021-22357
There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages due to validating inputs insufficiently. Attackers can exploit this vulnerability by sending specific messages to affected module. This can cause denial of service. Affected product versions...
CVE-2021-38475
The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissions...
CVE-2020-25926
The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning remote. The component is: dnsquerytype. The attack vector is: a specific DNS response packet...
Trend-spotting email techniques: How modern phishing emails hide in plain sight
With the massive volume of emails sent each day, coupled with the many methods that attackers use to blend in, identifying the unusual and malicious is more challenging than ever. An obscure Unicode character in a few emails is innocuous enough, but when a pattern of emails containing this obscur...
ansi_term is Unmaintained
The maintainer has advised that this crate is deprecated and will not receive any maintenance. The crate does not seem to have much dependencies and may or may not be ok to use as-is. Last release seems to have been three years ago. Possible Alternatives The below list has not been vetted in any...
RUSTSEC-2021-0139 ansi_term is Unmaintained
The maintainer has advised that this crate is deprecated and will not receive any maintenance. The crate does not seem to have much dependencies and may or may not be ok to use as-is. Last release seems to have been three years ago. Possible Alternatives The below list has not been vetted in any...
Vulnerability found in Microsoft Printer Spooler service
A vulnerability has been found in the Print Spooler service of Microsoft Windows. A local malicious person without administrator privileges can exploit this vulnerability by connecting to a rogue print server. From this print server, a printer driver is then installed. Although the driver should...
Cross site scripting
Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.7...
CVE-2021-28840
Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the uploadconfig function of sbin/httpd binary...
CVE-2021-28839
CVE-2021-28839 describes a null pointer dereference in the D-Link DAP-2310 (2.07.RC031), DAP-2330 (1.07.RC028), DAP-2360 (2.07.RC043), DAP-2553 (3.06.RC027), DAP-2660 (1.13.RC074), DAP-2690 (3.16.RC100), DAP-2695 (1.17.RC063), DAP-3320 (1.01.RC014), and DAP-3662 (1.01.RC022) in the upload_certifi...
Glovo: Getting a free delivery by singing up from "[email protected]"
Hello Getting a free delivery for food by just signing up from "[email protected]" and you also see the " FREE delivery Glovo Team ∞" in profile section. To cross check, i made a another account by using regular email-id "[email protected] " and placed a order with same location but i didn't g...
CVE-2021-37213
The check-in record page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record...
CVE-2021-37213
The check-in record page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record...
