[SECURITY] [DLA 2780-1] ruby2.3 security update

---------------------------------------------------------------------- Debian LTS Advisory DLA-2780-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 11, 2021 https://wiki.debian.org/LTS -...

Simple Issue Tracker System 1.0 - SQL injection Authentication Bypass Vulnerability

Exploit Title: Simple Issue Tracker System 1.0 - SQLi Authentication Bypass Exploit Author: Bekir Bugra TURKOGLU Vendor Homepage: https://www.sourcecodester.com/php/14938/simple-issue-tracker-system-project-using-php-and-sqlite-free-download.html Software Link:...

Anuko Time Tracker 跨站脚本漏洞

Anuko Time Tracker is an open source time counting system for individual developers. A platform for counting the time spent by employees on various tasks. Anuko Time Tracker suffers from a cross-site scripting vulnerability that stems from not checking the date parameter in the URI for correctnes...

[SECURITY] [DLA 2771-1] krb5 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2771-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 30, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2768-1] uwsgi security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2768-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler September 29, 2021 https://wiki.debian.org/LTS -...

WordPress Email Tracker plugin <= 5.2.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Email Tracker plugin versions = 5.2.5. Solution Update the WordPress Email Tracker plugin to the latest available version at least 5.2.6...

Deno's static imports inside dynamically imported modules do not adhere to permission checks

Impact Modules that are dynamically imported through import or new Worker might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing especially transitively untrusted code are...

GHSA-XPWJ-7V8Q-MCGJ Deno's static imports inside dynamically imported modules do not adhere to permission checks

Impact Modules that are dynamically imported through import or new Worker might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing especially transitively untrusted code are...

[SECURITY] [DLA 2763-1] ruby-kaminari security update

Debian LTS Advisory DLA-2763-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany September 22, 2021 https://wiki.debian.org/LTS Package : ruby-kaminari Version : 0.17.0-3+deb9u1 CVE ID : CVE-2020-11082 Debian Bug : 961847 A security vulnerability has been found in...

Budgets And Expense Tracker System 1.0 Shell Upload

Exploit Title: Budget and Expense Tracker System 1.0 - Remote Code Execution RCE Unauthenticated Exploit Author: Abdullah Khawaja hax.3xploit Date: 2021-09-21 Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html Software Link:...

[SECURITY] [DSA 4977-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4977-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 20, 2021 https://www.debian.org/security/faq -...

Budget and Expense Tracker System 1.0 - Authenticated Bypass Vulnerability

Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass Exploit Author: Prunier Charles-Yves Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html Software Link:...

[SECURITY] [DLA 2759-1] gnutls28 alternate chains verification

------------------------------------------------------------------------- Debian LTS Advisory DLA-2759-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler September 17, 2021 https://wiki.debian.org/LTS -...

StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)

Impact The formatter function that strips comments from a SQL contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Patches The...

[SECURITY] [DSA 4971-1] ntfs-3g security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4971-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 09, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4971-1] ntfs-3g security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4971-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 09, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4968-1] haproxy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4968-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 07, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DLA 2754-1] pywps security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2754-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 04, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 4966-1] gpac security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4966-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 31, 2021 https://www.debian.org/security/faq -...

SQL Injection - bypass login on B&E Tracker (by: oretnom23 ) v1.0

Description: The B&E Tracker by: oretnom23 v1.0 is vulnerable in the application /expensebudget/classes/Login.php which is called from /expensebudget/dist/js/script.js app. The parameter username from the login form is not protected correctly and there is no security and escaping from malicious...