USN-5927-1: Linux kernel (Azure) vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

CVE-2023-26779

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution RCE...

CVE-2023-26779

CVE-2023-26779 affects CleverStupidDog yf-exam v1.8.0. The vulnerability is described as a Deserialization flaw that can lead to Remote Code Execution (RCE). CVSS 3.1 base score 9.8 (CRITICAL) with NETWORK attack vector, low attack complexity, no privileges or user interaction required, and impac...

Sql injection

CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection...

CVE-2023-26780

CVE-2023-26780 affects CleverStupidDog yf-exam v1.8.0. The connected documents describe a SQL Injection vulnerability with high impact (CVSS 3.1: 9.8, NETWORK attack vector, no user interaction). No explicit remediation details are provided in the sources; one entry notes there is no information ...

Music Gallery Site 1.0 SQL Injection Vulnerability

Music Gallery Site - SQL Injection on page musiclist.php and parameter cid is vulnerable, application url is ?page=musiclist&cid=?. Any remote attacker can access this page to exploit the vulnerbility. CVE Assigned: CVE-2023-0938 mitre.org nvd.nist.org Author Name: Muhammad Navaid Zafar Ansari...

Cross site scripting

Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request...

CVE-2021-33387

CVE-2021-33387 is a Cross Site Scripting vulnerability in MiniCMS v1.10 that allows an attacker to execute arbitrary code through a crafted GET request. Related sources (NVD/NIST, Red Hat, OSV, CVE listings) consistently describe MiniCMS-1.10 as vulnerable to XSS with high impact (confidentiality...

CVE-2021-33387

Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request...

Security fix for the ALT Linux 10 package git version 2.33.7-alt1

2.33.7-alt1 built Feb. 20, 2023 Dmitry V. Levin in task 315248 Feb. 6, 2023 Dmitry V. Levin - 2.33.6 - 2.33.7 fixes: CVE-2023-22490, CVE-2023-23946...

CVE-2021-34182

An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions...

CVE-2021-34182

An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions...

CVE-2021-32163

Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization...

CVE-2021-32163

Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization...

Buffer overflow

Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltacc execution of the errorrefsym function...

Authentication flaw

Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization...

Default credentials

Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in the admin/index/email location...

CVE-2021-34182

An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions...

Two Supreme Court cases could change the Internet as we know it

The Supreme Court is about to reconsider Section 230, a law thats been the foundation of the way we have used the Internet for decades. The court will be handling a few cases that at first glance are about online platforms' liability for hosting accounts from foreign terrorists. But at a deeper...

SUSE CVE-2009-4605

scripts/setup.php aka the setup script in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the 1 configuration and 2 v0 parameters, which might allow remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...