Security Advisories.

Our security analysts practise responsible disclosure and report the zero-day vulnerabilities they discover. Below is a list that they have permission to publish. Due to security risks associated not all zero-days are published and accredited.  

CVE's published since 2016 = 87

CVE-2024-28097 XSS in Calendar functionality in Schoolbox

Akshay Raj

CVE-2024-28096 XSS in Class functionality in Schoolbox

Akshay Raj

CVE-2024-28095 XSS in News functionality in Schoolbox

Akshay Raj

CVE-2024-28094 SQL Injection in Chat functionality in Schoolbox

Akshay Raj

CVE-2023-6451 Publicly Known Cryptographic Machine Key In AlayaCare's Procura Portal Application

Jake Cleland

CVE-2023-4393 HTML and SMTP injections In LiquidFiles

Youssef Taleb

CVE-2023-1356 Reflected Cross-site Scripting In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-27377 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-27376 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-27375 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-27262 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-27261 Missing Authentication In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-27260 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-27257 Missing Authentication In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-27259 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-27258 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-27256 Missing Authentication In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-27255 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-27254 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26584 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26583 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26582 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26581 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26580 Unauthenticated Arbitrary File Read In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26579 Missing Authentication In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26578 Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26577 Stored Cross-site Scripting In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26576 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-26575 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-26574 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-26573 Missing Authentication In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26572 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26571 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-26570 Missing Authentication In IDAttend’s IDWeb Application

Melodi Dey

CVE-2023-26569 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-26568 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Jack Misiura

CVE-2023-22858 Improper Access Control in BlogEngine.NET version 3.3.8.0

Ahsan Aziz

CVE-2023-22857 Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

Ahsan Aziz

CVE-2023-22856 Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

Ahsan Aziz

CVE-2022-40296 Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Edward Prior

CVE-2022-40295 Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Edward Prior

CVE-2022-40294 Authenticated incubated vulnerability in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Edward Prior

CVE-2022-40293 Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Edward Prior

CVE-2022-40292 Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Edward Prior

CVE-2022-40291 Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Edward Prior

CVE-2022-40290 Reflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Edward Prior

CVE-2022-40289 Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality.

Edward Prior

CVE-2022-40288 Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality.

Edward Prior

CVE-2022-40287 Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.

Edward Prior

CVE-2022-39020 Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd.

Nelson Fernandes

CVE-2022-3059 SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd.

Nelson Fernandes

CVE-2022-39019 Broken access controls on PDFtron WebviewerUI in M-Files Hubshare

Michael Newton

CVE-2022-39018 Broken access controls on PDFtron data in M-Files Hubshare

Michael Newton

CVE-2022-39017 XSS in all comments fields in M-Files Hubshare

Michael Newton

CVE-2022-39016 Javascript injection in PDFtron in M-Files Hubshare

Michael Newton

CVE-2021-41750 Reflected cross-site scripting in CraftCMS SEOmatic plugin by Nystudio 107

Jack Misiura

CVE-2021-44618 Server-side Template Injection in CraftCMS SEOmatic plugin by Nystudio107

Jack Misiura

CVE-2021-41971 Cross-site scripting filter evasion in Alfresco Content Services

Jack Misiura and Stefano Lanaro

CVE-2021-41790 Broken access controls in Alfresco Content Services

Jack Misiura and Stefano Lanaro

CVE-2021-28316 FDE bypass and EoP on domain joined Windows workstations | The Missing Link

Matthew Johnson

CVE-2020-28001 Stored cross-site scripting in Serv-U File Server by SolarWinds | The Missing Link

Jack Misiura

CVE-2020-27994 Path traversal in Serv-U File Server by SolarWinds | The Missing Link

Jack Misiura

CVE-2020-28861 Missing access controls in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28860 Authenticated blind SQL injection in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28859 Reflected cross-site scripting in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28858 Cross-site request forgery in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28857 Stored cross-site scripting in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28856 IP access control bypass in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-29304 Self-reflected cross-site scripting in DirectoriesPro by SabaiApps | The Missing Link

Jack Misiura

CVE-2020-29303 Reflected cross-site scripting in DirectoriesPro by SabaiApps | The Missing Link

Jack Misiura

CVE-2020-11497 Payment system bypass in NAB Transact WooCommerce Plugin by Tyson Armstrong | The Missing Link

Jack Misiura

CVE-2020-11727 Reflected cross-site scripting in Advanced Order Export for WooCommerce by AlgolPlus | The Missing Link

Jack Misiura

CVE-2019-13181 CSV injection vulnerability in SolarWinds Serv-U | The Missing Link

Richard Tan

CVE-2019-13182 Stored cross-site scripting in SolarWinds Serv-U | The Missing Link

Richard Tan

CVE-2019-0972 Local Security Authority Subsystem Service (LSASS) Remote Denial of Service | The Missing Link

Danyal Drew and Elad Shamir

Linux Privilege Escalation via LXD | The Missing Link

Chris Moberly

CVE-2018-19999 Local Privilege Escalation via Serv-U FTP Server | The Missing Link

Chris Moberly

CVE-2019-7304 Local privilege escalation in Ubuntu Linux and derivatives | The Missing Link

Chris Moberly

CVE-2018-7669 Sitecore Directory Traversal Vulnerability | The Missing Link

Chris Moberly

CVE-2018-13415 Out-of-Band XXE in SSDP Processing of Plex Media Server | The Missing Link

Chris Moberly

CVE-2018-13416 Out-of-Band XXE in SSDP Processing of Universal Media Server | The Missing Link

Chris Moberly

CVE-2018-13417 Out-of-Band XXE in SSDP Processing of Vuze Bitorrent Client | The Missing Link

Chris Moberly

CVE-2018-19934 Reflected XSS in SolarWinds Serv-U FTP Server | The Missing Link

Chris Moberly

CVE-2018-15906 Application Privilege Escalation in SolarWinds Serv-U | The Missing Link

Chris Moberly

CVE-2018-11002 Pulse Secure Desktop Client (Windows) 5.3 Elevation of Privilege Vulnerability | The Missing Link

Matt Bush

CVE-2017-16878 Reflected cross-site scripting in PAN-OS Captive Portal | The Missing Link

Shaun Wheelhouse

CVE-2016-4573 FortiSwitch rest_admin account exposed under certain conditions | The Missing Link

Emma Ferguson

Latest News

Living off the land (LotL) Attacks: How cybercriminals exploit your own tools

Living off the land (LotL) Attacks: AI and Machine Learning as your best defence

You’ve chosen a managed IT service provider – what comes next?

See All News