Security Advisories

Our security analysts practise responsible disclosure and report the zero-day vulnerabilities they discover. Below is a list that they have permission to publish. Due to security risks associated not all zero-days are published and accredited.  

CVE-2021-41750 Reflected cross-site scripting in CraftCMS SEOmatic plugin by Nystudio 107

Jack Misiura

CVE-2021-44618 Server-side Template Injection in CraftCMS SEOmatic plugin by Nystudio107

Jack Misiura

CVE-2021-41971 Cross-site scripting filter evasion in Alfresco Content Services

Jack Misiura and Stefano Lanaro

CVE-2021-41790 Broken access controls in Alfresco Content Services

Jack Misiura and Stefano Lanaro

CVE-2021-28316 FDE bypass and EoP on domain joined Windows workstations | The Missing Link

Matthew Johnson

CVE-2020-28001 Stored cross-site scripting in Serv-U File Server by SolarWinds | The Missing Link

Jack Misiura

CVE-2020-27994 Path traversal in Serv-U File Server by SolarWinds | The Missing Link

Jack Misiura

CVE-2020-28861 Missing access controls in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28860 Authenticated blind SQL injection in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28859 Reflected cross-site scripting in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28858 Cross-site request forgery in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28857 Stored cross-site scripting in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-28856 IP access control bypass in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Jack Misiura

CVE-2020-29304 Self-reflected cross-site scripting in DirectoriesPro by SabaiApps | The Missing Link

Jack Misiura

CVE-2020-29303 Reflected cross-site scripting in DirectoriesPro by SabaiApps | The Missing Link

Jack Misiura

CVE-2020-11497 Payment system bypass in NAB Transact WooCommerce Plugin by Tyson Armstrong | The Missing Link

Jack Misiura

CVE-2020-11727 Reflected cross-site scripting in Advanced Order Export for WooCommerce by AlgolPlus | The Missing Link

Jack Misiura

CVE-2019-13181 CSV injection vulnerability in SolarWinds Serv-U | The Missing Link

Richard Tan

CVE-2019-13182 Stored cross-site scripting in SolarWinds Serv-U | The Missing Link

Richard Tan

CVE-2019-0972 Local Security Authority Subsystem Service (LSASS) Remote Denial of Service | The Missing Link

Danyal Drew and Elad Shamir

Linux Privilege Escalation via LXD | The Missing Link

Chris Moberly

CVE-2018-19999 Local Privilege Escalation via Serv-U FTP Server | The Missing Link

Chris Moberly

CVE-2019-7304 Local privilege escalation in Ubuntu Linux and derivatives | The Missing Link

Chris Moberly

CVE-2018-7669 Sitecore Directory Traversal Vulnerability | The Missing Link

Chris Moberly

CVE-2018-13415 Out-of-Band XXE in SSDP Processing of Plex Media Server | The Missing Link

Chris Moberly

CVE-2018-13416 Out-of-Band XXE in SSDP Processing of Universal Media Server | The Missing Link

Chris Moberly

CVE-2018-13417 Out-of-Band XXE in SSDP Processing of Vuze Bitorrent Client | The Missing Link

Chris Moberly

CVE-2018-19934 Reflected XSS in SolarWinds Serv-U FTP Server | The Missing Link

Chris Moberly

CVE-2018-15906 Application Privilege Escalation in SolarWinds Serv-U | The Missing Link

Chris Moberly

CVE-2018-11002 Pulse Secure Desktop Client (Windows) 5.3 Elevation of Privilege Vulnerability | The Missing Link

Matt Bush

CVE-2017-16878 Reflected cross-site scripting in PAN-OS Captive Portal | The Missing Link

Shaun Wheelhouse

CVE-2016-4573 FortiSwitch rest_admin account exposed under certain conditions | The Missing Link

Emma Ferguson

Latest News

How to build a cyber security plan: A guide for SMEs

Cyber Essentials Decoded: Firewalls and User Access Control

Cyber Essentials Decoded: Malware Protection

See All News