Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program. Date published : 2020-12-25 https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page. Date published : 2020-12-25 https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. Date published : 2020-12-25 https://support.esri.com/en/bugs/nimbus/QlVHLTAwMDEyODA2MA== https://support.esri.com/en/technical-article/000022931
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait)...
Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker’s client for use...
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal. Date published : 2020-12-25 https://github.com/alexlang24/bloofoxCMS/issues/7
phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config – Import Administrators" page. Date published : 2020-12-25 https://sourceforge.net/projects/phplist/files/phplist/ https://tufangungor.github.io/exploit/2020/12/15/phplist-3.5.9-sql-injection.html
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. Date published : 2020-12-25 https://github.com/Bottelet/DaybydayCRM/releases https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen. Date published : 2020-12-25 https://github.com/Bottelet/DaybydayCRM/releases https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen. Date published : 2020-12-25 https://github.com/Bottelet/DaybydayCRM/releases https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen. Date published : 2020-12-25 https://github.com/Bottelet/DaybydayCRM/releases https://tufangungor.github.io/exploit/2020/12/12/daybydaycrm-2.1.0-multiple-stored-xss.html
A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5,...
Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls. Date published : 2020-12-25 https://github.com/gobby/gobby/pull/184
Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI. Date published : 2020-12-25 http://packetstormsecurity.com/files/160783/Subrion-CMS-4.2.1-Cross-Site-Scripting.html https://github.com/intelliants/subrion/issues/880