🚨 CVE-2020-21176
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
🎖@cveNotify
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
🎖@cveNotify
blog.jiguang.xyz
thinkjs - sql注入漏洞分析 · 极光 - 再见已是故人
Vulnerability Report: Thinkjs Blind SQL Injection 本文档描述了Thinkjs project的一个盲注漏洞，由于关系数据库中model.increment(field, step) 和 model.decrement(field, step)函数对step的参数缺少检查，恶意的参数可以导致程序在处
🚨 CVE-2020-21180
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.
🎖@cveNotify
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.
🎖@cveNotify
GitHub
koa2-blog v1.0.0 sql injection vulnerability · Issue #41 · wunci/Koa2-blog
A sql injection was discovered in koa2-blog 1.0.0 .There is a sql injection vulnerability which allows remote attackers to Injecting a malicious SQL statement into a server via: post http://127.0.0...
🚨 CVE-2020-20290
Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability.
🎖@cveNotify
Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability.
🎖@cveNotify
🚨 CVE-2020-20295
An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands.
🎖@cveNotify
An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands.
🎖@cveNotify
GitHub
Vulnerability Report: cmswing 1.3.8 updateAction sql injection · Issue #50 · arterli/CmsWing
Find a code execution vulnerability in cmswing project version 1.3.8，Details can be found in the analysis below. Vulnerability Location The vulnerability lies in the updateAction function in the cm...
🚨 CVE-2020-25036
UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command.
🎖@cveNotify
UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command.
🎖@cveNotify
Globadis works
Ucopia V6 : Multiple CVE used to root the host
Ucopia V6 : Multiple CVE used to root the host - Globadis works.
🚨 CVE-2020-1896
A stack overflow vulnerability in Facebook Hermes ‘builtin apply’ prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2) allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
🎖@cveNotify
A stack overflow vulnerability in Facebook Hermes ‘builtin apply’ prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2) allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
🎖@cveNotify
GitHub
Added stack overflow check for hermes::vm:: hermesBuiltinApply · facebook/hermes@86543ac
Summary: This adds a missing check for stack overflow.
Reviewed By: tmikov
Differential Revision: D20104955
fbshipit-source-id: 1f37e23d2e28ebcd3aa4176d134b8418e7059ebd
Reviewed By: tmikov
Differential Revision: D20104955
fbshipit-source-id: 1f37e23d2e28ebcd3aa4176d134b8418e7059ebd
🚨 CVE-2020-24335
An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.
🎖@cveNotify
An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.
🎖@cveNotify
GitHub
GitHub - adamdunkels/uip: The historical uIP sources
The historical uIP sources. Contribute to adamdunkels/uip development by creating an account on GitHub.
🚨 CVE-2020-28495
This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
🎖@cveNotify
This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
🎖@cveNotify
🚨 CVE-2020-28494
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
🎖@cveNotify
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
🎖@cveNotify
GitHub
Fixed "Command Injection" in `image.stream()` - thank to Sam Sanoop. · totaljs/framework@6192491
Node.js framework. Contribute to totaljs/framework development by creating an account on GitHub.
🚨 CVE-2020-8101
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions.
🎖@cveNotify
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions.
🎖@cveNotify
Bitdefender Labs
Cracking the LifeShield: Unauthorized Live-Streaming in your Home
Also, CVE-2020-8101 - Command execution due to unsanitized input Do-it-yourself home security solutions are centerpieces of the modern lifestyle. From sensors to surveillance and... #ADT #Lifeshield
🚨 CVE-2020-25506
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
🎖@cveNotify
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
🎖@cveNotify
Gist
Disclosure of vulnerabilities in D-LInk DNS320
Disclosure of vulnerabilities in D-LInk DNS320 . GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2021-26271
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
🎖@cveNotify
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
🎖@cveNotify
GitHub
ckeditor4/CHANGES.md at major · ckeditor/ckeditor4
The best enterprise-grade WYSIWYG editor. Fully customizable with countless features and plugins. - ckeditor4/CHANGES.md at major · ckeditor/ckeditor4
🚨 CVE-2021-26272
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
🎖@cveNotify
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
🎖@cveNotify
GitHub
ckeditor4/CHANGES.md at major · ckeditor/ckeditor4
The best enterprise-grade WYSIWYG editor. Fully customizable with countless features and plugins. - ckeditor4/CHANGES.md at major · ckeditor/ckeditor4
🚨 CVE-2020-24549
openMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the underlying web server.
🎖@cveNotify
openMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the underlying web server.
🎖@cveNotify
Exploit Database
openMAINT 1.1-2.4.2 - Arbitrary File Upload
openMAINT 1.1-2.4.2 - Arbitrary File Upload.. webapps exploit for JSON platform
🚨 CVE-2020-28194
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
🎖@cveNotify
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
🎖@cveNotify
GitHub
radius: sanity check for vendor attribute length · accel-ppp/accel-ppp@e9d369a
High performance PPTP/L2TP/SSTP/PPPoE/IPoE server for Linux - accel-ppp/accel-ppp
🚨 CVE-2020-18568
The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause remote command execution.
🎖@cveNotify
The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause remote command execution.
🎖@cveNotify
Gist
Disclosure of vulnerabilities in D-Link DSR-250 DSR-1000N router.md
Disclosure of vulnerabilities in D-Link DSR-250 DSR-1000N router.md - Disclosure of vulnerabilities in D-Link DSR-250 DSR-1000N router.md
🚨 CVE-2021-25312
HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method.
🎖@cveNotify
HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method.
🎖@cveNotify
🚨 CVE-2021-22698
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
🎖@cveNotify
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
🎖@cveNotify
Se
Security Notification - EcoStruxure Power Build - Rapsody | Schneider Electric
Download Security Notification - EcoStruxure Power Build - Rapsody Technical leaflet
🚨 CVE-2020-28948
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
🎖@cveNotify
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
🎖@cveNotify
GitHub
Multiple vulnerabilities through filename manipulation (CVE-2020-28948 and CVE-2020-28949) · Issue #33 · pear/Archive_Tar
I have submitted this to the PEAR bug tracker as well as the PEAR group mailing list, and I'm not sure if either has gone through, so opening an issue here with the hope that this is the right ...
🚨 CVE-2020-28949
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
🎖@cveNotify
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
🎖@cveNotify
packetstorm.news
Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers
🚨 CVE-2021-3165
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
🎖@cveNotify
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
🎖@cveNotify