Easy Org Chart <= 3.1 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

Security Bulletin: NVIDIA GPU Display Driver - August 2022

NVIDIA has released a software security update for NVIDIA GPU Display Driver. This update addresses issues that may lead to denial of service, information disclosure, escalation of privileges, code execution, or data tampering. To protect your system, download and install this software update...

GHSA-M2WW-6WV6-VW3C Cross site scripting in Concrete CMS

XSS in /dashboard/blocks/stacks/viewdetails/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot...

Path traversal in Concrete CMS

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...

GHSA-6XC4-7FMM-65Q2 Code injection in concrete CMS

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concretesecure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-21829

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concretesecure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http...

Design/Logic Flaw

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-30118

CVE-2022-30118 involves Cross‑Site Scripting in PortlandLabs Concrete CMS. The vulnerability lies in the /dashboard/system/express/entities/forms/save_control/[GUID] path where old browsers, specifically Internet Explorer with XSS protection disabled, can edit a form control in Concrete 8.5.7 and...

CVE-2022-30119

The CVE-2022-30119 entry concerns a Cross-Site Scripting (XSS) vulnerability in Concrete CMS, specifically in the /dashboard/reports/logs/view path. The vulnerability arises from insufficient sanitization/output of built URLs, enabling XSS on older browsers when Internet Explorer XSS protection i...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

Security Bulletin: NVIDIA DGX A100 Firmware - June 2022

NVIDIA has released a security update for NVIDIA DGX A100 firmware. This update addresses issues that may lead to information disclosure, denial of service, or escalation of privileges. To protect your system, download and install this firmware update through the NVIDIA Enterprise Support Portal...

CVE-2021-46110

Online Shopping Portal (version 3.1) contains multiple time-based SQL injection vulnerabilities in the email and contactno parameters. This is evidenced by PT-2022-12571, which specifies affected version 3.1 and exploitation via those parameters, with recommended mitigation to restrict access to ...

CVE-2021-45761

ROPium v3.1 was discovered to contain an invalid memory address dereference via the find function...

CVE-2021-45761

ROPium v3.1 was discovered to contain an invalid memory address dereference via the find function...

Design/Logic Flaw

ROPium v3.1 was discovered to contain an invalid memory address dereference via the find function...

CVE-2021-45761

ROPium v3.1 was discovered to contain an invalid memory address dereference via the find function...

CVE-2021-45761

CVE-2021-45761 concerns the ROPium v3.1 library, where an invalid memory address dereference in the find() function is reported. The vulnerability’s root cause is a memory access issue in an internal routine, with CVSS-3.1 indicating a HIGH impact on availability and network attack vector, and no...

Security Bulletin: NVIDIA SHIELD TV - January 2022

NVIDIA has released a software security update for NVIDIA SHIELD® TV. This update addresses issues that may lead to information disclosure, denial of service, code execution, or escalation of privileges. To protect your system, download and install this software update through Settings About Syst...

Design/Logic Flaw

In Concrete CMS formerly concrete 5 below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit...