Monthly Archive: August 2021

All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function. Date published : 2021-08-24...

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a...

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker’s control. Date published : 2021-08-24 http://tusk1.cn/2019/05/12/DeDecms-v5-7-sp2-CRSF-%E6%96%87%E4%BB%B6%E6%93%8D%E4%BD%9C-%E5%89%8D%E5%8F%B0getshell/

EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcms_web/Search.php component via the attr_array parameter. This vulnerability allows attackers to access sensitive database information. Date published : 2021-08-24 http://tusk1.cn/2019/03/21/ESPCMS-P8%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E4%B8%8E%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB%E6%BC%8F%E6%B4%9E/

D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the ‘/etc/passwd’ file.If an attacker succeeds in recovering the cleartext password of the identified hash value, he will be able to log...

D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the ‘/etc/passwd’ file. As weak passwords have been used, the plaintext passwords can be recovered from the hash values. Date published : 2021-08-23 https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10236...

D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the ‘/etc/passwd’ file. As weak passwords have been used, the plaintext passwords can be recovered from the hash values....

Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function. Date published : 2021-08-23 https://github.com/flatCore/flatCore-CMS/issues/53

Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code. Date published : 2021-08-23 http://packetstormsecurity.com/files/164047/FlatCore-CMS-2.0.7-Remote-Code-Execution.html https://github.com/flatCore/flatCore-CMS/issues/52

A Buffer Overflow vulnerabilty exists in Miniftpd 1.0 in the do_mkd function in the ftpproto.c file, which could let a remote malicious user cause a Denial of Service. Date published : 2021-08-23 https://github.com/Gabe-commiter/Miniftpd/issues/1

Multiple Cross Site Scripting (XSS) vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in (1) public/search.php and in the (2) c parameter in admin.php. Date published : 2021-08-23 https://github.com/cbkhwx/cxuucmsv3/issues/7

Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711,...

Certain NetModule devices allow Limited Session Fixation via PHPSESSID. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720,...

Certain NetModule devices have Insecure Password Handling (cleartext or reversible encryption), These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710,...