TYPO3 mm_forum extension cross-site request forgery vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. mmforum extension is one of the forum extensions. A cross-site request forgery vulnerability exists in TYPO3 mmforum extension 1.9.5 and earlier versions. The vulnerability stems from a WEB...

GitHub Flavored Markdown Input Validation Error Vulnerability

GitHub Flavored Markdown is a CommonMark parsing and rendering library for use in C from GitHub, USA. An input validation error vulnerability exists in versions prior to GitHub Flavored Markdown 0.29.0.gfm.1. The vulnerability stems from a networked system or product that does not properly valida...

OpenSSH Information Disclosure Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers from the Openbsd Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection hijacking, an...

MK-AUTH SQL Injection Vulnerability

MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A SQL injection vulnerability exists in the mkt/ PHP script in MK-AUTH version 19.01, which can be exploited by an attacker to execute illegal SQL commands...

Support Incident Tracker SQL Injection Vulnerability (CNVD-2021-25275)

Support Incident Tracker SiT! is a PHP and MySQL based technical support phone/email tracking system. A SQL injection vulnerability exists in Support Incident Tracker version 3.67 p2. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...

Bludit cross-site scripting vulnerability (CNVD-2021-22131)

Bludit is a simple, fast and secure flat file CMS. A stored cross-site scripting vulnerability exists in bl-kernel/ajax/logo-upload.php in Bludit 3.12.0. An attacker can exploit this vulnerability to inject arbitrary JavaScript and HTML code...

The vulnerability of the Win32k component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Win32k component of the Windows operating system is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to increase their privileges...

K8tools

It is an offensive tool for web application exploitation. The repository, K8tools, contains a collection of tools for various purposes, including internal penetration, privilege escalation, remote overflow, vulnerability exploitation, scanning, password cracking, and anti-kill tools. The primary...

CISOfy Lynis Competitive Conditions Issue Vulnerability

CISOfy Lynis is a system security auditing tool from CISOfy Netherlands that supports multiple platforms. A Competing Conditions Issue vulnerability exists in CISOfy Lynis versions prior to 3.0.0. An attacker could exploit the vulnerability to bypass symbolic link checks and manipulate data in lo...

CERT NZ Releases Advisory on Ransomware Campaign

The New Zealand Computer Emergency Response Team CERT NZ has released an advisory on a ransomware campaign leveraging remote access technologies. Malicious cyber actors are targeting organizations’ networks through remote access tools, such as Remote Desktop Protocol and virtual private networks,...

Baxter Phoenix Hemodialysis Delivery System (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Baxter Equipment: Phoenix Hemodialysis Delivery System Vulnerability: Cleartext Transmission of Sensitive Information 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

CVE-2020-14400

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary...

Microsoft Office SharePoint cross-site scripting vulnerability (CNVD-2021-24037)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Microsoft Windows Error Reporting Information Disclosure Vulnerability (CNVD-2021-27707)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Error Reporting WER is one of the error reporting components. An information...

Microsoft Windows Graphics Component Information Disclosure Vulnerability (CNVD-2021-25010)

Microsoft Windows is an operating system for personal devices from Microsoft.Windows Graphics is one of the graphics components. An information disclosure vulnerability exists in the Microsoft Windows Graphics component, which arises from a program's failure to properly handle objects in memory,...

Microsoft Project Information Disclosure Vulnerability

Microsoft Project is a suite of project management software from the American company Microsoft Microsoft. The software is used to assist project managers in developing plans, allocating resources to tasks, tracking progress, managing budgets and analyzing workloads. An information disclosure...

Microsoft Windows Information Disclosure Vulnerability (CNVD-2021-27709)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An information disclosure vulnerability exists in Microsoft Windows, which arises when a...

Microsoft Excel Remote Code Execution Vulnerability (CNVD-2021-24041)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel, which arises from the program not properly handling objects in memory, and can be exploited to execute arbitrary code in the context of the...

Upload whitelisted files to any directory in OctoberCMS

Impact An attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the...

Sourcefabric Newscoop Code Issue Vulnerability

Sourcefabric Newscoop is a content management system. A code issue vulnerability exists in Sourcefabric Newscoop version 4.4.7. An attacker can exploit this vulnerability to execute arbitrary PHP code on the server...