Print Spooler Remote DLL Injection

The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Module Options msf use...

The vulnerability of the qsvghandler.cpp component of the cross-platform development framework for Qt software, related to the lack of a mechanism for checking input data, allows attackers to trigger service failures.

The vulnerability of the qsvghandler.cpp component of the cross-platform framework for developing Qt software is related to the lack of a mechanism for checking input data. Exploiting this vulnerability allows an attacker to trigger a service failure by using an altered SVG image...

The vulnerability of the EncodeImage function in the coders/pict.c component of the console image editing tool ImageMagick, which involves reading data beyond the allowed buffer limits, allows a hacker to cause a service failure.

The vulnerability of the EncodeImage function in the coders/pict.c component of the console-based graphic editor ImageMagick involves reading data from beyond the allowed buffer limits. Exploiting this vulnerability allows a malicious actor to cause service interruptions by using a specially...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL server set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress WP S...

Cross site scripting

Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's ListItem component used in the pages and files section for example displayed HTML in page titles as it is. This could be used for cross-site scripting XSS attacks. Malicious authenticated Panel users can...

CVE-2020-27361

An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories...

Keystone Engine 安全漏洞

Keystone Engine is an assembler framework. A security vulnerability exists in Keystone Engine that stems from Keystone Engine having an invalid idle in llvmks::SmallVectorImpl::SmallVectorImpl...

ruby: HTTP response splitting in WEBrick

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients...

CVE-2021-31516

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2021-31516

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2021-31515

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2021-31515

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2021-31515

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2021-31516

CVE-2021-31516 affects Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). The flaw is in BNDB file parsing where the code does not validate the existence of an object before performing operations, enabling a remote attacker to execute code in the current process. Exploitation requires user inte...

CVE-2021-31515

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 Build ID 88f343c3. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2021-31515

CVE-2021-31515 affects Vector 35 Binary Ninja 2.3.2660 and relates to BNDB file parsing. The flaw is an out-of-bounds read caused by insufficient validation of user-supplied BNDB data, which can let an attacker execute code in the target process. Exploitation requires user interaction (visiting a...

Infoblox NIOS 安全漏洞

Infoblox NIOS is an operating system that powers Infoblox core network services. It ensures uninterrupted operation of the network infrastructure. A security vulnerability exists in Infoblox NIOS versions prior to 8.5.2, which stems from a program that allows entity expansion during an XML upload...

Zenly: Friend Request Flow Exposes User Data

Summary: When submitting a friend request to a user, Zenly will allow access to their phone number regardless of whether the friend request is accepted or not. To obtain this information, a malicious actor only needs to know their username. Steps To Reproduce: To reproduce this issue, an...