โผ CVE-2021-33824 โผ
๐ Read
via "National Vulnerability Database".
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-31272 โผ
๐ Read
via "National Vulnerability Database".
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-31662 โผ
๐ Read
via "National Vulnerability Database".
RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sensitive information.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-33186 โผ
๐ Read
via "National Vulnerability Database".
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24368 โผ
๐ Read
via "National Vulnerability Database".
The Quiz And Survey Master รยขรขโยฌรขโฌล Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link๐ Read
via "National Vulnerability Database".
โผ CVE-2020-20467 โผ
๐ Read
via "National Vulnerability Database".
White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the vulnerability to create a task.๐ Read
via "National Vulnerability Database".
โผ CVE-2020-20466 โผ
๐ Read
via "National Vulnerability Database".
White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user.๐ Read
via "National Vulnerability Database".
โผ CVE-2020-20471 โผ
๐ Read
via "National Vulnerability Database".
White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default_user_edit.php, remote attackers can exploit this vulnerability to escalate to admin privileges.๐ Read
via "National Vulnerability Database".
โผ CVE-2020-20473 โผ
๐ Read
via "National Vulnerability Database".
White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the control_task.php, control_project.php, default_user.php files failing to filter the sort parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-31769 โผ
๐ Read
via "National Vulnerability Database".
MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in the %PROGRAMFILES%\MyQ\PHP\Sessions directory. The "Select server file" feature is only intended for administrators but actually does not require authorization. An attacker can inject arbitrary OS commands (such as commands to create new .php files) via the Task Scheduler component.๐ Read
via "National Vulnerability Database".
๐ด Are Ransomware Attacks the New Pandemic? ๐ด
๐ Read
via "Dark Reading".
Ransomware has been a problem for decades, so why is government just now beginning to address it?๐ Read
via "Dark Reading".
โผ CVE-2020-7031 โผ
๐ Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.๐ Read
via "National Vulnerability Database".
โผ CVE-2020-22390 โผ
๐ Read
via "National Vulnerability Database".
Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened.๐ Read
via "National Vulnerability Database".
โผ CVE-2006-0016 โผ
๐ Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.๐ Read
via "National Vulnerability Database".
โ iPhone Wi-Fi Crushed by Weird Network โ
๐ Read
via "Threat Post".
โฆ until you reset network settings and stop connecting to a weirdly named network, that is. FUD is spreading. iOS Wi-Fi demolition is not.๐ Read
via "Threat Post".
Threat Post
iPhone Wi-Fi Crushed by Weird Network
โฆ until you reset network settings and stop connecting to one weirdly named network, that is. FUD is spreading. iOS Wi-Fi demolition is not, though it could.
โผ CVE-2021-0522 โผ
๐ Read
via "National Vulnerability Database".
In ConnectionHandler::SdpCb of connection_handler.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-174182139๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0520 โผ
๐ Read
via "National Vulnerability Database".
In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-176237595๐ Read
via "National Vulnerability Database".
โผ CVE-2020-19510 โผ
๐ Read
via "National Vulnerability Database".
Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-32697 โผ
๐ Read
via "National Vulnerability Database".
neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent. Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data. Alternatively a custom Finisher can be added as first finisher. This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567๐ Read
via "National Vulnerability Database".
โ Embryology Data Breach Follows Fertility Clinic Ransomware Hit โ
๐ Read
via "Threat Post".
Approximately 38,000 of RBA's customers had their embryology data stolen by a ransomware gang.๐ Read
via "Threat Post".
Threat Post
Embryology Data Breach Follows Fertility Clinic Ransomware Hit
Approximately 38,000 of RBA's customers had their embryology data stolen by a ransomware gang.