vulnerability - Malwlab

vulnerability

Znuny ships a patch for a 9.5 auth bypass and a SQL injection that share one root cause

Two newly published Znuny vulnerabilities, both fixed in 7.3.7 and LTS 6.5.25, trace back to the same class of bug: unvalidated HTTP header input reaching privileged code paths.

vulnerability

Metabase's sample database was a file read/write back door

Metabase ships with a sample database so you can try the product before wiring up your own. That sample runs on H2, an embedded Java database, and for most users it is a harmless playground. For anyone with native-query access, it was a back door to the server'

A self-hosted task board on one screen, and a session token drifting across to another page on the same machine

security

Vikunja's patch streak: 29 advisories, four releases, one default that bites

Test excerpt.