Security

Alessandro Stesi

Multiple vulnerabilities in cPanel <= 60.0.34

Alessandro Stesi

Stop User Enumeration does not stop user enumeration (WordPress plugin)

Alessandro Stesi

Zend Framework / zend-mail < 2.4.11 Remote Code Execution (CVE-2016-10034)

Piergiorgio Venuti

MySQL / MariaDB / PerconaDB – Privilege Escalation / Race Condition Exploit [CVE-2016-6663 / OCVE-2016-5616]

Piergiorgio Venuti

Cross-Site Scripting in Check Email WordPress Plugin

Piergiorgio Venuti

Cross-Site Scripting in All In One WP Security & Firewall WordPress Plugin

Piergiorgio Venuti

Nginx (Debian-based distros) – Root Privilege Escalation Vulnerability (CVE-2016-1247)

Piergiorgio Venuti

Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin

Piergiorgio Venuti

Cross-Site Scripting in Calendar WordPress Plugin

Piergiorgio Venuti

Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin

Piergiorgio Venuti

Cross-Site Scripting vulnerability in Quotes Collection WordPress Plugin

Piergiorgio Venuti

MySQL / MariaDB / PerconaDB – Root Privilege Escalation Exploit ( CVE-2016-6664 / CVE-2016-5617 )

Piergiorgio Venuti

[oss-security] CVE request:Lynx invalid URL parsing with ‘?’

Condividi


RSS

Piu’ articoli…

Categorie …

Tags

RSS Feed sconosciuto

RSS Feed sconosciuto

RSS Full Disclosure

  • ESP-RFID-Tool v2 PRO — Full Public Disclosure 29 Aprile 2026
    Posted by Milan Berger via Fulldisclosure on Apr 29# Security Advisory: ESP-RFID-Tool v2 PRO **Product:** ESP-RFID-Tool v2 PRO **Vendor:** Raik Schneider (Einstein2150), foto-video-it.de **Repository:** https://github.com/Einstein2150/ESP-RFID-Tool-v2 **Affected Version:** v2.2.1 (latest as of 2026-04-28) **Severity:** CRITICAL **Disclosure Type:** Full Public Disclosure **Disclosure Date:** 2026-04-28 **Researcher:** Milan &apos;t4c&apos; Berger --- ## Disclosure Timeline | Date | Event |...
  • Re: SEC Consult SA-20260427-0 :: Missing TLS Certificate Validation leading to RCE in DeskTime Time Tracking App 29 Aprile 2026
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 29*Update 2026-04-28:* The vendor contacted us and now provides a patched version v1.3.674 which can be obtained at the following URL: https://desktime.com/download
  • SEC Consult SA-20260427-0 :: Missing TLS Certificate Validation leading to RCE in DeskTime Time Tracking App 29 Aprile 2026
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 29SEC Consult Vulnerability Lab Security Advisory < 20260427-0 > ======================================================================= title: Missing TLS Certificate Validation leading to RCE product: DeskTime Time Tracking App vulnerable version: 1.3.671 fixed version: - CVE number: CVE-2025-10539              impact: medium homepage:https://desktime.com...
  • SEC Consult SA-20260423-0 :: DLL Hijacking in EfficientLab Controlio (cloud-based employee monitoring service) 29 Aprile 2026
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 29SEC Consult Vulnerability Lab Security Advisory < 20260423-0 > ======================================================================= title: DLL Hijacking product: EfficientLab Controlio (cloud-based employee monitoring service) vulnerable version:
  • SEC Consult SA-20260421-0 :: Broken Access Control in Config Endpoint in LiteLLM 29 Aprile 2026
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 29SEC Consult Vulnerability Lab Security Advisory < 20260421-0 > ======================================================================= title: Broken Access Control in Config Endpoint product: LiteLLM vulnerable version:
  • SEC Consult SA-20260415-0 :: Exposed Private Key of X.509 Certificate in SAP HANA Cockpit & SAP HANA Database Explorer 29 Aprile 2026
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 29SEC Consult Vulnerability Lab Security Advisory < 20260415-0 > ======================================================================= title: Exposed Private Key of X.509 Certificate             product: SAP HANA Cockpit & SAP HANA Database Explorer vulnerable version: HANA Cockpit
  • APPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8 29 Aprile 2026
    Posted by Apple Product Security via Fulldisclosure on Apr 29APPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8 iOS 18.7.8 and iPadOS 18.7.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127003. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Notification Services Available for: iPhone […]
  • APPLE-SA-04-22-2026-1 iOS 26.4.2 and iPadOS 26.4.2 29 Aprile 2026
    Posted by Apple Product Security via Fulldisclosure on Apr 29APPLE-SA-04-22-2026-1 iOS 26.4.2 and iPadOS 26.4.2 iOS 26.4.2 and iPadOS 26.4.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127002. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Notification Services Available for: iPhone […]
  • Research: When Trusted Tools Become Attack Primitives 29 Aprile 2026
    Posted by Nir Yehoshua on Apr 29Hi Full Disclosure list, I published a technical research article titled: When Trusted Tools Become Attack Primitives The article examines how trusted local utilities can become security-relevant primitives when used inside automated processing pipelines. It covers two case studies: 1. macOS textutil resolving remote resources during HTML-to-text conversion. 2. […]
  • [KIS-2026-08] SocialEngine <= 7.8.0 (get-memberall) SQL Injection Vulnerability 29 Aprile 2026
    Posted by Egidio Romano on Apr 29----------------------------------------------------------------- SocialEngine

Customers

Newsletter

{subscription_form_2}