CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...

Microsoft Word 缓冲区错误漏洞

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. A remote code execution vulnerability exists in Microsoft Word, which can be exploited by an attacker to execute code on the target host...

Unbreakable Enterprise kernel security update

5.4.17-2036.102.0.2uek - xen-blkback: set ring-xenblkd to NULL after kthreadstop Pawel Wieczorkiewicz Orabug: 32260252 CVE-2020-29569 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253409 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch SeongJae...

Linux kernel 路径遍历漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions prior to 5.10.7, which stems from insufficient identifier checking in drivers/target/targetcorexcopy.c, and can be...

Microsoft Word 安全漏洞

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. A remote code execution vulnerability exists in Microsoft Word, which can be exploited by an attacker to execute code on the target host...

UBUNTU-CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...

Denial of Service Vulnerability in libreCMC

libreCMC is a completely free embedded operating system for general-purpose computers. A denial of service vulnerability exists in libreCMC. An attacker can exploit the vulnerability by sending a carefully constructed packet to a specific destination address to cause a denial of service to the...

Denial of Service Vulnerability in TP-Link TL-WDR8690 Easy Show Edition

The TL-WDR8690 Easy Show Edition is a wireless router. A denial of service vulnerability exists in the TP-Link TL-WDR8690 Easy Show Edition. An attacker can exploit the vulnerability to cause a denial of service to the target router and its upper tier operator's router by sending a carefully...

Nessus Scanners Scanning Attempt

Nessus is a vulnerability scanning product. Remote attackers can use Nessus to detect vulnerabilities on a target server...

Longtongue - Customized Password/Passphrase List Inputting Target Info

Customized Password/Passphrase List inputting Target Info Installation git clone https://github.com/edoardottt/longtongue.git cd longtongue python3 longtongue.py Usage usage: longtongue.py -h -p | -c | -v -l | -L -y -n Customized Password/Passphrase List inputting Target Info optional arguments:...

Formstone Cross-Site Scripting Vulnerability

Formstone is a front-end component codebase from the Formstone team. Formstone has a security vulnerability in version 1.4.16 and earlier caused by a failure to properly validate user-supplied input in the -target.php and upload-block.php folder in an upload. A remote attacker can exploit this...

Exif-Gps-Tracer - A Python Script Which Allows You To Parse GeoLocation Data From Your Image Files Stored In A dataset

A python script which allows you to parse GeoLocation data from your Image files stored in a dataset.It also produces output in CSV file and also in HTML Google Maps Prerequisite To run this script fluently , 1 You should have Google Maps API 2 You should enable Map JavaScript API in Console To g...

Formstone 跨站脚本漏洞

Formstone is a front-end component codebase from the Formstone team. Formstone has a security vulnerability in version 1.4.16 and earlier caused by a failure to properly validate user-supplied input in the -target.php and upload-block.php folder in an upload. A remote attacker can exploit this...

MikroTik RouterOS Cross-Site Scripting Vulnerability (CNVD-2021-01532)

MikroTik RouterOS is the operating system for the MikroTik RouterBOARD hardware. A reflected cross-site scripting vulnerability exists in the hotspot login page in MikroTik RouterOS 2021-01-04 and earlier. An attacker can exploit this vulnerability via the target parameter to conduct a cross-site...

CVE-2021-3014

In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter...

Knockpy 4.1.1 CSV Injection

Exploit Title: Knockpy 4.1.1 - CSV Injection Author: Dolev Farhi Date: 2020-12-29 Vendor Homepage: https://github.com/guelfoweb/knock Version : 4.1.1 Tested on: Debian 9.13 Knockpy, as part of its subdomain brute forcing flow of a remote domain, issues a HEAD request to the server to fetch detail...

Mikrotik MikroTik RouterOS 跨站脚本漏洞

MikroTik RouterOS is the operating system for the MikroTik RouterBOARD hardware. A reflected cross-site scripting vulnerability exists in the hotspot login page in MikroTik RouterOS 2021-01-04 and earlier. An attacker can exploit this vulnerability via the target parameter to conduct a cross-site...

Citrix Provisioning Services Boot Degradation With Cylance Protect

1. Target Device TD boot times increase when Cylance Protect 2.1 is installed within the vDisk. The boot delay is after the OS has been delivered to the Target Device and is now resident in RAM. This is after our Target has transitioned from Single IO to Multi IO mode in a BIOS based TD...

Web Servers Memory Corruption Attempt (CVE-2020-12000; CVE-2020-13934; CVE-2020-3239; CVE-2020-9490)

A memory corruption vulnerability can be exploited by malicious actors. Successful exploitation could cause damage to target systems...

Input validation

There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this...