PT-2021-18757

Name of the Vulnerable Software and Affected Versions Zulip Server versions 3.x before 3.4 Description The issue allows organization administrators to move messages to streams in other organizations hosted by the same Zulip installation, using the topic moving API. Recommendations For Zulip Serve...

CVE-2020-35337

ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands...

CVE-2020-35337: Improper Neutralization of Special Elements used in an SQL Command

ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands...

PT-2021-11754

Name of the Vulnerable Software and Affected Versions: ThinkSAAS versions prior to 3.38 Description: The issue allows remote attackers to execute arbitrary SQL commands through a SQL injection vulnerability. This vulnerability is exploited through the "app/topic/action/admin/topic.php" endpoint v...

Cyberattacks See Fundamental Changes, A Year into COVID-19

COVID-19-related phishing emails, brute-force attacks on remote workers, and a focus on exploiting or abusing collaboration platforms are the hallmarks of cybercriminal enterprise as the coronavirus marks its first anniversary of going global. A year after the COVID-19 crisis was officially...

CVE-2021-20236

A flaw was found in the ZeroMQ server. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system...

OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-03047)

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via a task...

Open-xchange OX App Suite 跨站脚本漏洞

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via a task...

IBM MQ 8.0 <= 8.0.0.10 / 9.0.1 <= 9.0.5 CD / 9.0 <= 9.0.0.5 LTS / 9.1 <= 9.1.0.0 LTS (734297)

The version of IBM MQ Server running on the remote host is affected by a vulnerability. IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456. Note that Nessus has not tested for this issue but...

CVE-2020-6882

ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The remote attacker could use this credential to connect to the MQTT server, so as to obtain information about other devices by sending specifi...

activemq: remote XSS in web console diagram plugin

A flaw was found in activemq. A specifically crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info...

F5 Networks BIG-IP : BIG-IP MQTT iRule vulnerability (K62830532)

When your system handlesMQTT traffic through a BIG-IP virtual server associated with an MQTT profile, and an iRule performs manipulations on that traffic, TMM may produce a core file. CVE-2020-5935 Impact The Traffic Management Microkernel TMM may generate a core file and restart, causing a high...

CVE-2020-14194

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

CVE-2020-14194

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

PT-2020-13923

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 2.1.5 Description The issue allows reverse tabnapping via a topic header link. Recommendations For versions prior to 2.1.5, update to version 2.1.5 or later to resolve the issue...

CVE-2020-14194: Improper Privilege Management

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

OPENSUSE-SU-2020:1141-1 Security update for targetcli-fb

This update for targetcli-fb fixes the following issues: - CVE-2020-13867: Fixed the permissions in /etc/target bsc1172743 This update was imported from the SUSE:SLE-15-SP1:Update update project...

PT-2020-13788

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0 Description A specially crafted MQTT packet with an XSS payload as client-id or topic name can exploit this issue. The XSS payload is injected into the admin console's browser and is...

GHSA-5X3V-2GXR-59M2 Directory traversal in Apache RocketMQ

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversa...

Directory Traversal

rocketmq-broker is vulnerable to directory traversal. The automatic topic creation which is enabled by default, allows a folder name containing ../ characters to be created. This results in the writing of arbitrary directory in the parent directories, potentially overwriting existing folders...