PT-2021-2168 · Luxion · Keyvr +3

Name of the Vulnerable Software and Affected Versions: Luxion KeyShot versions prior to 10.1 Luxion KeyShot Viewer versions prior to 10.1 Luxion KeyShot Network Rendering versions prior to 10.1 Luxion KeyVR versions prior to 10.1 Description: The issue is related to NULL pointer dereference...

Regular Expression Denial Of Service (ReDoS)

@ckeditor/ckeditor5-markdown-gfm is vulnerable to regular expression denial of service. The vulnerability exists because of unescaped Urls in the DataProcessor...

Information Disclosure

github.com/moby/buildkit is vulnerable to information disclosure. The os.OpenFile in util/binfmtmisc/check.go uses an unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call, resulting in the creation of unnecessary file that can contain confidenti...

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)

Update Feb 3, 2021: It has been reported that macOS, AIX, and Solaris are also vulnerable to CVE-2021-3156, and that others may also still be vulnerable. Qualys has not independently verified the exploit. Original Post: The Qualys Research Team has discovered a heap overflow vulnerability in sudo...

Denial Of Service (DoS)

jointjs is vulnerable to denial of service. The vulnerability exist as the user input to the unsetByPath function is not sanitized properly...

Cisco UCS Manager 2.2(1d) Remote Command Execution

import sys, ssl, os, time import requests from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning Exploit Title : Cisco UCS Manager - 2.21d - Remote Command Execution Description : An unspecified CGI script in Cisco...

301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection

The plugin does not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections. The PoC video provided mentioned 2.53 as vulnerable, however v2.45 was installed and used. The issue has been verified to have been fixed in 2.51 PoC POST...

Authorization Bypass

coturn is vulnerable to authorization bypass. An attacker is able to bypass validation to connect and relay packets to the loopback address...

Vulristics Vulnerability Score, Automated Data Collection and Microsoft Patch Tuesdays Q4 2020

In this episode I would like to make a status update of my Vulristics project. For those who dont know, in this project I retrieve publicly available vulnerability data and analyze it to better understand the severity of these vulnerabilities and better prioritize them. Currently, it is mainly...

PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval

Exploit Title: PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval Date: 9 Jan 2021 Exploit Author: rootabeta Vendor Homepage: The original page, https://dmitryivanov.net/, cannot be found at this time of writing. The vulnerable software can be downloaded from...

Prototype Pollution in dominictarr/libnested

Description libnested is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var libnested = require"libnested" var obj = console.log"Before : " + .polluted; libnested.setobj, 'proto','polluted', 'Yes! Its Polluted'; console.log"After : " + .polluted; 2...

Denial Of Service (DoS)

github.com/tidwall/gjson is vulnerable to denial of service. An attacker is able to crash the application via a malicious GET call which would result in a slice bounds out of range...

Information Disclosure

github.com/go-vela/compiler is vulnerable to information disclosure. An attacker is able to obtain server configuration information using the Sprig's env function...

Open Redirection

jupyter-server is vulnerable to open redirection. A remote attacker is able to redirect a user to a malicious website via a malicious link to a jupyter server...

CVE-2020-35545

Time-based SQL injection exists in Spotweb 1.4.9 via the query string...

PT-2020-13588 · Nzxt · Nzxt Cam

Name of the Vulnerable Software and Affected Versions: NZXT CAM version 4.8.0 Description: An information disclosure issue exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality. A specially crafted I/O request packet IRP using the IRP 0x9c4060d4 allows a low privilege user to...

PT-2020-13595 · Nzxt · Nzxt Cam

Name of the Vulnerable Software and Affected Versions: NZXT CAM version 4.8.0 Description: An information disclosure issue exists in the WinRing0x64 Driver IRP 0x9c402084 functionality. A specially crafted I/O request packet IRP can cause the disclosure of sensitive information. An attacker can...

Authentication Bypass

react-adal is vulnerable to authentication bypass. An attacker is able to bypass authentication using a malicious JWT token which would be treated as authentic due to an insecure validation on the nonce...

PT-2020-13150 · Wago · Wago Plc Family 750-352 +1

Name of the Vulnerable Software and Affected Versions: WAGO PLC family 750-88x versions FW1 through FW10 WAGO PLC family 750-352 versions FW1 through FW10 Description: The issue is related to a denial of service attack. Older firmware versions of the WAGO PLC family are affected. Recommendations:...

PT-2020-19565 · Mcafee · Mcafee Database Security Server/Sensor

Name of the Vulnerable Software and Affected Versions: McAfee Database Security Server and Sensor versions prior to 4.8.0 Description: The issue is related to the use of a broken or risky cryptographic algorithm in the form of a SHA1 signed certificate. This could allow an attacker on the same...