Validation Bypass

httpclient is vulnerable to validation bypass. A malformed authority component in the request URIs that is passed to the library as java.net.URI object would result in the request execution for a wrong target host...

Debian DLA-2405-1 : httpcomponents-client security update

Oleg Kalnichevski discovered that httpcomponents-client, a Java library for building HTTP-aware applications, can misinterpret a malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. For Debian 9 stretch,...

libcroco security update

0.6.12-6 - Rebuild with 7.9-z target Related: 1835951 0.6.12-5 - Fix CVE-2020-12825 Resolves: 1835951...

Exploit for SQL Injection in Drupal

vulnerability-list 常见漏洞快速检测，目前包含以下漏洞。 Tomcat： - CVE201712615 / CVE201712617 - tomcatweakpassword - examplevulnerability检测tomcat的examples等目录是否存在 moon.py -u tomcat http://xx.xx.xx.xx:xxxx Fckeditor - 获取版本及常见上传页面检测 - fck moon.py -u fck http://xx.xx.xx.xx/fckxx Weblogic - CVE201710271...

libvirt security and bug fix update

4.5.0-36 - virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support rhbz1823976 - virDevMapperGetTargetsImpl: quit early if device is not a devmapper target rhbz1823976 4.5.0-35 - qemu: dont take agent and monitor job for shutdown CVE-2019-20485 - qemu: dont hold a monitor and agent...

bootstrap: XSS in the data-target attribute

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

libvirt: Potential denial of service via active pool without target path

A NULL pointer dereference was found in the libvirt API responsible for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection...

PT-2020-13472 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 12.10.13 Description: An issue has been discovered in GitLab where it was vulnerable to a stored XSS in the Wiki pages. Recommendations: For versions prior to 12.10.13, update to version 12.10.13 or later to resolve t...

ismartgate PRO Cross-Site Request Forgery Vulnerability

iSmartGate is a smart garage door opener system. The ismartgate PRO suffers from a cross-site request forgery vulnerability that allows a remote attacker to exploit the vulnerability to construct a malicious URI, bait a request, and can perform a malicious operation in the context of the target...

Jenkins 2.56 CLI Deserialization / Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Jenkins CLI Deserialization', 'Description' = %q An unauthenticated Java object deserialization vulnerability exists in the CLI component for...

CRLFuzz - A Fast Tool To Scan CRLF Vulnerability Written In Go

A fast tool to scan CRLF vulnerability written in Go Installation from Binary The installation is easy. You can download a prebuilt binary from releases page, unpack and run! or with $ curl -sSfL http://git.io/get-crlfuzz | sh -s -- -b /usr/local/bin from Source If you have go1.13+ compiler...

Citrix WEM Agents not Synchronizing Error “No Connection Could be Made Because The Target Machine Actively Refused it”

Citrix Virtual Delivery Agents running Workspace Environment Management WEM Agents are not synchronizing with two or more WEM Broker servers load balanced via Citrix Gateway. Policies delivered through WEM are not applying to agents Event Viewer shows the following error:“No connection could be...

VMware Workstation ThinPrint JPEG2000 Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

IBM BladeCenter Cross-Site Request Forgery Vulnerability (CNVD-2020-52190)

IBM Blade Center is an IBM server management program. IBM Blade Center suffers from a cross-site request forgery vulnerability that can be exploited by a remote attacker to construct a malicious URI, bait a request, and can be used to perform a malicious operation in the context of the target use...

IBM BladeCenter Cross-Site Request Forgery Vulnerability

IBM Blade Center is an IBM server management program. IBM Blade Center suffers from a cross-site request forgery vulnerability that can be exploited by a remote attacker to construct a malicious URI, bait a request, and can be used to perform a malicious operation in the context of the target use...

MZAP - Multiple Target ZAP Scanning

Multiple target ZAP Scanning / mzap is a tool for scanning NN in ZAP. Concept Installation go-get $ go get -u github.com/hahwul/mzap snapcraft $ sudo snap install mzap --devmode homebrew $ brew tap hahwul/mzap $ brew install mzap Usage Usage: mzap command Available Commands: ajaxspider Add...

Remote code execution

A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with...

Microsoft Windows Routing Utilities Denial of Service Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A denial of service vulnerability exists in Microsoft Windows Routing Utilities, which ste...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-68740)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows Server. The vulnerability stems...