[FD] Hyland OnBase 19.x and below - Unrestricted File Upload

2020-09-11 Thread AdaptiveSecurity Consulting via Fulldisclosure
CVSSv3.1 Score - AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Vendor - Hyland Software - ( https://www.hyland.com/en/ and https://www.onbase.com/en/ ) Product --

[FD] Hyland OnBase 19.x and below - Data Import Denial Of Service

2020-09-11 Thread AdaptiveSecurity Consulting via Fulldisclosure
CVSSv3.1 Score - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Vendor - Hyland Software - (https://www.hyland.com/en/ and https://www.onbase.com/en/) Product - Hyl

[FD] Two vulnerabilities found in MikroTik's RouterOS

2020-09-11 Thread Q C
Advisory: two vulnerabilities found in MikroTik's RouterOS Details === Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description == RouterOS is th

[FD] Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37

2020-09-11 Thread Daniel Bishtawi via Fulldisclosure
Hello, We are informing you about Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37. Information Advisory by Netsparker Name: Cross-Site Scripting in IlchCMS Affected Software: IlchCMS Affected Versions: 2.1.37 Vendor Homepage: https://www.ilch.de/ Vulnerability Type: C

[FD] CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze

2020-09-11 Thread Jason Geffner
CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze -- Summary === Name: Remote Code Execution as SYSTEM/root via Backblaze CVE: CVE-2020-8150 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windo

[FD] CVE-2020-8152 – Elevation of Privilege in Backblaze

2020-09-11 Thread Jason Geffner
CVE-2020-8152 – Elevation of Privilege in Backblaze --- Summary === Name: Elevation of Privilege in Backblaze CVE: CVE-2020-8152 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: High Discove

[FD] Windows TCPIP Finger Command / C2 Channel and Bypassing Security Software

2020-09-11 Thread hyp3rlinx
[+] Title: Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software [+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt [+] tw