HCL Technologies BigFix Mobile/Modern Client Management 代码问题漏洞

HCL Technologies BigFix Mobile/Modern Client Management is a mobile device management software client from HCL Technologies, India. A security vulnerability exists in HCL Technologies BigFix Mobile/Modern Client Management v1.x, v2.0, which can be exploited by attackers to conduct Un-Auth XML...

OESA-2022-1623 varnish security update

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x,...

CVE-2022-27352

Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

Debian: Security Advisory (DSA-5106-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink

A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests...

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...

PT-2022-11456

Name of the Vulnerable Software and Affected Versions Sourcecodester Banking System version 1 Description The issue allows attackers to execute arbitrary SQL commands via the username or password field, potentially leading to unauthorized access or data manipulation. Recommendations For...

Security fix for the ALT Linux 10 package apache2 version 1:2.4.52-alt1

1:2.4.52-alt1 built Dec. 27, 2021 Anton Farygin in task 292417 Dec. 21, 2021 Anton Farygin - 2.4.52 Fixes: CVE-2021-44790, CVE-2021-44224...

Security fix for the ALT Linux 10 package apache2 version 1:2.4.51-alt1

1:2.4.51-alt1 built Oct. 11, 2021 Anton Farygin in task 286598 Oct. 10, 2021 Anton Farygin - 2.4.51 Fixes: CVE-2021-42013...

Security fix for the ALT Linux 9 package apache2 version 1:2.4.50-alt1

Oct. 7, 2021 Anton Farygin 1:2.4.50-alt1 - 2.4.50 Fixes: CVE-2021-41773, CVE-2021-41524...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0...

CVE-2021-28233

Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the okjpggeneratehuffmantable function in okjpg.c...

Security fix for the ALT Linux 9 package systemd version 1:246.16-alt1

1:246.16-alt1 built Aug. 20, 2021 Alexey Shabalin in task 283283 Aug. 18, 2021 Alexey Shabalin - 246.16 Fixes CVE-2020-13529 - Package /lib/systemd/system-shutdown and /lib/systemd/system-sleep dirs ALT 39349. - Delete resovconfopenresolv settings before add ALT 33589...

CVE-2021-21501

Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0...

Apache ServiceComb Service-Center 路径遍历漏洞

Apache ServiceComb Service-Center is a Restful-based service registry from the Apache Foundation that provides microservice discovery and microservice management. Apache ServiceComb Service-Center is vulnerable to a path traversal vulnerability in version 1.x.x. The vulnerability stems from A...

Customer Relationship Management System (CRM) 1.0 - Sql Injection Authentication Bypass

Exploit Title: Customer Relationship Management System CRM 1.0 - Sql Injection Authentication Bypass Date: 27/07/2021 Exploit Author: ShafiqueWasta Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html Software Link:...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

💥 BUG xss via groupname 💥 VERSION TESTED latest version as of 1/7/21 💥 IMPACT xss allow to execute arbitary javascript in vicitm account 💥 STEP TO REPRODUCE 1. first goto http://localhost/online-invoice2/app/admin/pageEditGroup.php and add a new group and put bellow xss payload in group-name....

Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

Impact The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions: - A user is allowed to supply the path or filename of an uploaded file. - The supplied...

Debian DLA-2683-1 : rxvt security update

rxvt, VT102 terminal emulator for the X Window System, allowed potentially remote code execution because of improper handling of certain escape sequences ESC G Q. For Debian 9 stretch, this problem has been fixed in version 1:2.7.10-7+deb9u2. We recommend that you upgrade your rxvt packages. For...

TYPO3 跨站脚本漏洞

TYPO3 is a free and open source content management system framework from the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in version 1.x prior to TYPO3 1.3.3, which stems from insufficient innocuous handling of user-supplied data, and can be exploited by attackers to condu...