:: Deepquest ::

orangescrum 1.8.0 – ‘Multiple’ Cross-Site Scripting (XSS) (Authenticated)

orangescrum 1.8.0 – Privilege escalation (Authenticated)

Gerdab.ir suffers from a remote SQL injection vulnerability.

Bagisto version 1.3.3 suffers from a client-side template injection vulnerability.

Backdoor.Win32.Coredoor.10.a malware suffers from bypass and code execution vulnerabilities.

Email-Worm.Win32.Deltad malware suffers from an insecure permissions vulnerability.

Backdoor.Win32.Coredoor.10.a malware suffers from a man-in-the-middle vulnerability.

D-Link DSL-3782 pre-authentication remote root exploit.

This Metasploit module exploits CVE-2021-40539, a REST API authentication bypass vulnerability in ManageEngine ADSelfService Plus, to upload a JAR and execute it as the user running ADSelfService Plus – which is SYSTEM if started as a service.

Bagisto 1.3.3 – Client-Side Template Injection