2981 matches found
HTTPLoot - An Automated Tool Which Can Simultaneously Crawl, Fill Forms, Trigger Error/Debug Pages And "Loot" Secrets Out Of The Client-Facing Code Of Sites
An automated tool which can simultaneously crawl, fill forms, trigger error/debug pages and "loot" secrets out of the client-facing code of sites. Usage To use the tool, you can grab any one of the pre-built binaries from the Releases section of the repository. If you want to build the source cod...
CVE-2022-44832
D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function...
Privilege Escalation
github.com/aws/amazon-cloudwatch-agent is vulnerable to privilege escalation. The vulnerability exists when a user triggers a repair of the Agent which results in a pop-up window opening with SYSTEM permissions on Windows, allowing an attacker with administrative access to create a new command...
PT-2022-7125 · Keepass +2 · Keepass +3
Name of the Vulnerable Software and Affected Versions: KeePass versions 2.53 and earlier KeePass through 2.53 in a default installation Description: The issue is related to the storage of critical information in an unencrypted manner. An attacker with write access to the XML configuration file ca...
Superio - Job Board < 1.2.33 - Subscriber+ Stored Cross-Site Scripting
The theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Stored Cross-Site Scripting attacks. As a candidate, add the following payload on the Social Network option: javascript:alert1 As a recruiter, access the candidate page an...
GSD-2022-1008337 iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: trigger: sysfs: fix possible memory leak in iiosysfstriginit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.334 by commit...
GSD-2022-1008286 iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: trigger: sysfs: fix possible memory leak in iiosysfstriginit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.300 by commit...
GSD-2022-1008220 iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: trigger: sysfs: fix possible memory leak in iiosysfstriginit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.267 by commit...
GSD-2022-1008141 iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: trigger: sysfs: fix possible memory leak in iiosysfstriginit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.225 by commit...
PT-2022-35970 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to a possible memory leak in the at91 adc allocate trigger function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kerne...
PT-2022-35969 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to a possible memory leak in the iio sysfs trig init function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...
PT-2022-36147 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.5 through v5.15.79 Description: A potential memory leak issue exists in the at91 adc allocate trigger function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...
PT-2022-36476 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.267 Description: A potential memory leak issue exists in the at91 adc allocate trigger function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...
Google Apps Login < 3.4.5 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to the setting page of this plugin. 2...
Null pointer dereference
A null pointer dereference vulnerability exists in the handleioctl8314C functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet IRP can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability...
Jenkins Generic Webhook Trigger Plugin External Entity Injection (CVE-2021-21669)
An XXE vulnerability exists in Jenkins Generic Webhook Trigger Plugin. The vulnerability is due to insufficient validation of input parameters. Successful exploitation could lead to the disclosure of file contents for any file readable by Jenkins...
The vulnerability of the Systemd initialization and service management subsystem, related to bypassing authentication through spoofing, allows a perpetrator to trigger a service failure.
The vulnerability of the Systemd service initialization and management subsystem relates to bypassing authentication through spoofing. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...
Missing Authorization in Jenkins XP-Dev Plugin
A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-specified repository...
GHSA-V535-PC6R-77QH Lack of authentication mechanism for webhook in CloudBees Docker Hub/Registry Notification Plugin
CloudBees Docker Hub/Registry Notification Plugin provides several webhook endpoints that can be used to trigger builds when Docker images used by a job have been rebuilt. In CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier, these endpoints can be accessed without authenticatio...