* Home

* Bugtraq

* Full List

*

* Only Bugs

* Only Tricks

* Only Exploits

* Only Dorks

* Only CVE

* Only CWE

*

* Fake Notes

*

* Ranking

* CVEMAP

* Full List

*

* Show Vendors

* Show Products

*

* CWE Dictionary

*

* Check CVE Id

* Check CWE Id

* Search

* Bugtraq

*

* CVEMAP

*

* By author

*

* CVE Id

* CWE Id

*

* By vendors

* By products

* RSS

* Bugtraq

*

* CVEMAP

* CVE Products

*

* Bugs

* Exploits

* Dorks

* More

* cIFrex

*

* Facebook

* Twitter

*

* Donate

*

* About

* Submit

BUGTRAQ STATS

Yesterday: 6

Last month: 207

Current month: 210

Total: 36396

BEST HACKERS:

1. Seccops

2. Luis Sandoval

3. Emre Aslan

4. Anastasios Stasinop...

CVE DATABASE

Last Update: 46

Last month: 1515

Current month: 1490

Total CVE: 152065

AFFECTED

1. INTERACTIVE...

(9)

2. STERLING B2...

(7)

3. IOT FIELD N...

(7)

4. EDK2 (7)

RANDOM COMMENT

DEJ CMS SQL INJECTION

Crunk

Nah

VOTED

WPJOBBOARD PLUGIN V5.6.4 - UNAUTHENTICATED SQ...

+4 0

WONDER CMS 3.1.3 CROSS SITE SCRIPTING

+3 0

WORDPRESS PLUGIN YOAST SEO 15.2.1 - REMOTE FI...

+0 -6

Check the Bugtraq

2020-11-25

LOW

BigBlueButton E-mail Validation Bypass CVE-2020-29043

Seccops

MED.

BigBlueButton Meeting Access Code Brute Force Vulnerability

CVE-2020-29042

Seccops

MED.

Wondershare Driver Install Service Help 10.7.1.321 Unquoted Service

Path

Luis Sandoval

HIGH

SyncBreeze 10.0.28 password Remote Buffer Overflow Abdessalam king(A.salam)

LOW

WordPress Simple File List Unauthenticated Remote Code Execution

h00die

MED.

OpenMediaVault rpc.php Authenticated PHP Code Injection Anastasios Stasinopoulos

HIGH

Kong Gateway Admin API Remote Code Execution

Graeme Robinson

LOW

osCommerce 2.3.4.1 Cross Site Scripting

Emre Aslan

2020-11-24

MED.

User Registration & Login and User Management System 2.1 Login Bypass

SQL Injection

Mayur Parmar

MED.

Powered By Trynet Solutions Sql Injection Vulnerability

behrouz mansoori

MED.

CyberDairy Solutions Sql Injection Vulnerability

behrouz mansoori

HIGH

ZeroShell 3.9.0 Remote Command Execution CVE-2019-12725 Juan Manuel Fernandez

LOW

OpenCart 3.0.3.6 Cross Site Scripting

Hemant Patidar

THE LATEST CVES

2020-11-25

CVE-2020-29070

OSCOMMERCE 2.3.4.1 HAS XSS VULNERABILITY VIA THE AUTHENTICATED USER ENTERING THE XSS PAYLOAD INTO THE TITLE SECTION OF NEWSLETTERS.

CVE-2020-26243

NANOPB IS A SMALL CODE-SIZE PROTOCOL BUFFERS IMPLEMENTATION. IN NANOPB BEFORE VERSIONS 0.4.4 AND 0.3.9.7, DECODING SPECIFICALLY FORMED MESSAGE CAN LEAK MEMORY IF DYNAMIC ALLOCATION IS ENABLED AND AN ONEOF FIELD CONTAINS A STATIC SUBMESSAGE THAT CONTAINS A DYNAMIC FIELD, AND THE MESSAGE BEING DECODED CONTAINS THE SUBMESSAGE MULTIPLE TIMES. THIS

IS R...

CVE-2020-26212

'PLANNING'. 2. COPY THE CALDAV URL AND USE A CALDAV CLIENT (E.G. THUNDERBIRD) TO SYNC THE PLANNING WITH THE PROVIDED URL. 3. INFORM THE USERNAME AND PASSWORD FROM ANY VALID USER (E.G. 'CAMILA' FROM 'PROATIVA' GROUP). 4. 'CAMILA' HAS READ-ONLY ACCESS TO 'EDUARDO.MOZART' PERSONAL PLANNING. THE SAME BEHAVIOR HAPPENS TO ANY GROUP. E.G. 'CAMILA' HAS ACCESS TO 'IT' GROUP PLANNING, EVEN IF SHE DOESN'T BELONG TO THIS GROUP AND HAS A 'SELF-SERVICE' PROFILE PERMISSION). THIS ISSUE IS FIXED IN VERSION 9.5.3. AS A WORKAROUND, ONE CAN REMOVE THE `CALDAV.PHP` FILE TO BLOCK ACCESS TO CALDAV SERVER." STYLE="TEXT-DECORATION: NONE;">GLPI STANDS FOR GESTIONNAIRE LIBRE DE PARC INFORMATIQUE AND IT IS A FREE ASSET AND IT MANAGEMENT SOFTWARE PACKAGE, THAT PROVIDES ITIL SERVICE DESK FEATURES, LICENSES TRACKING AND SOFTWARE AUDITING. IN GLPI BEFORE VERSION 9.5.3, ANY AUTHENTICATED USER HAS READ-ONLY PERMISSIONS TO THE PLANNING OF EVERY OTHER USER, EVEN ADMIN ONES. STEPS TO REPRODUCE ...

CVE-2020-25650

A FLAW WAS FOUND IN THE WAY THE SPICE-VDAGENTD DAEMON HANDLED FILE TRANSFERS FROM THE HOST SYSTEM TO THE VIRTUAL MACHINE. ANY UNPRIVILEGED LOCAL GUEST USER WITH ACCESS TO THE UNIX DOMAIN SOCKET PATH `/RUN/SPICE-VDAGENTD/SPICE-VDAGENT-SOCK` COULD USE THIS FLAW TO PERFORM A MEMORY DENIAL OF SERVICE FOR SPICE-VDAGENTD OR EVEN OTHER PROCESSES IN THE VM...

CVE-2020-29072

A CROSS-SITE SCRIPT INCLUSION VULNERABILITY WAS FOUND ON LIQUIDFILES BEFORE 3.3.19. THIS CLIENT-SIDE ATTACK REQUIRES USER INTERACTION (OPENING A LINK) AND SUCCESSFUL EXPLOITATION COULD LEAD TO ENCRYPTED E-MAIL CONTENT LEAKAGE VIA MESSAGES/SENT?FORMAT=JS AND

POPUP?FORMAT=JS.

CVE-2020-29071

AN XSS ISSUE WAS FOUND IN THE SHARES FEATURE OF LIQUIDFILES BEFORE 3.3.19. THE ISSUE ARISES FROM THE INSECURE RENDERING OF HTML FILES UPLOADED TO THE PLATFORM AS ATTACHMENTS, WHEN THE -HTMLVIEW URL IS DIRECTLY ACCESSED. THE IMPACT RANGES FROM EXECUTING COMMANDS AS ROOT ON THE SERVER TO RETRIEVING SENSITIVE INFORMATION ABOUT ENCRYPTED

E-MAILS, DEPEN...

CVE-2020-26242

GO ETHEREUM, OR "GETH", IS THE OFFICIAL GOLANG IMPLEMENTATION OF THE ETHEREUM PROTOCOL. IN GETH BEFORE VERSION 1.9.18, THERE IS A DENIAL-OF-SERVICE (CRASH) DURING BLOCK PROCESSING. THIS IS FIXED IN

1.9.18.

CVE-2020-26241

GO ETHEREUM, OR "GETH", IS THE OFFICIAL GOLANG IMPLEMENTATION OF THE ETHEREUM PROTOCOL. THIS IS A CONSENSUS VULNERABILITY IN GETH BEFORE VERSION 1.9.17 WHICH CAN BE USED TO CAUSE A CHAIN-SPLIT WHERE VULNERABLE NODES REJECT THE CANONICAL CHAIN. GETH'S PRE-COMPILED DATACOPY (AT 0X00...04) CONTRACT DID A SHALLOW COPY ON INVOCATION. AN

ATTACK...

CVE-2020-26240

GO ETHEREUM, OR "GETH", IS THE OFFICIAL GOLANG IMPLEMENTATION OF THE ETHEREUM PROTOCOL. AN ETHASH MINING DAG GENERATION FLAW IN GETH BEFORE VERSION 1.9.24 COULD CAUSE MINERS TO ERRONEOUSLY CALCULATE POW IN AN UPCOMING EPOCH (ESTIMATED EARLY JANUARY, 2021). THIS HAPPENED ON THE ETC CHAIN ON 2020-11-06. THIS ISSUE IS RELEVANT ONLY FOR MINER...

2020-11-24

CVE-2020-29069

_GET_FLAG_IP_LOCALDB IN SERVER/MHN/UI/UTILS.PY IN MODERN HONEY NETWORK (MHN) THROUGH 2020-11-23 ALLOWS ATTACKERS TO CAUSE A DENIAL-OF-SERVICE VIA AN IP ADDRESS THAT IS ABSENT FROM A LOCAL GEOLOCATION DATABASE, BECAUSE THE CODE TRIES TO UPPERCASE A RETURN VALUE EVEN IF THAT VALUE

IS NOT A STRING.

DORKS

2020-11-24

MED.

POWERED BY TRYNET SOLUTIONS SQL INJECTION VULNERABILITY "POWERED BY TRYNET SOLUTIONS"

BEHROUZ MANSOORI

MED.

CYBERDAIRY SOLUTIONS SQL INJECTION VULNERABILITY "DESIGNED BY STAR WEB MAKER"

BEHROUZ MANSOORI

2020-11-23

MED.

WATERS COMPUTER CONSULTANTS SQL INJECTION VULNERABILITY "WEBSITE BY WATERS COMPUTER CONSULTANTS"

BEHROUZ MANSOORI

MED.

DEVELOPED BY CLICK INFORMATICS - SQL INJECTION VULNERABILITY "DEVELOPED BY CLICK INFORMATICS"

BEHROUZ MANSOORI

MED.

MADE BY CAPITALWEBAPPS - SQL INJECTION VULNERABILITY "MADE BY CAPITALWEBAPPS"

BEHROUZ MANSOORI

QUICK GOTO:

Bugtraq The latest CVEs

Dorks

Search

* Bugtraq

*

* CVEMAP

*

* By Author

*

* CVE Id

* CWE Id

*

* By vendors

* By products

ARE YOU LOOKING CVE FOR SOME PRODUCT?

TOP VENDORS:

Apple Microsoft

Google

Oracle

Apache

IBM

Red Hat

HP

Adobe

Mozilla

Full List of Vendors -------------------------

TOP PRODUCTS:

LINUX KERNEL

MAC OS X WINDOWS

XP WINDOWS 10

FLASH

PLAYER ADOBE

READER PHP

JRE

JDK

WORDPRESS

JOOMLA CHROME

IE

FIREFOX

SAFARI

HTTPD

TOMCAT

NGINX

FULL LIST OF PRODUCTS -------------------------

TOP CWE:

CWE-89 (SQL INJECTION) CWE-79 (XSS) CWE-119 (BUFFER OVERFLOW) CWE-22 (PATH TRAVERSAL) CHECK CWE DICTIONARY -------------------------

DONATE:

is an open project developed and moderated fully by one independent

person.

Help develop the project and makeDonations ------------------------- Copyright 2020, cxsecurity.com

Back to Top