За плечами белоруса Сергея Макарова — годы работы режиссером телешоу и сериалов, а еще три бизнеса в сфере разведения насекомых. Нам в Россельхозбанке его история показалась очень интересной, и мы попросили Сергея рассказать ее для читателей блога. Надеемся, его опыт будет вам полезен и интересен. Читать далее
A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file removeUser.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220220.
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter.
ezEIP v5.3.0(0649) was discovered to contain a cross-site scripting (XSS) vulnerability.
CRMEB 4.4.4 is vulnerable to Any File download.
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions.
Western Digital My Cloud devices before OS5 have a nobody account with a blank password.
Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation.