CVE-2001-0680

CVE-2001-0680 QPC QVT/Net 4.0 및 AVT/Term 5.0의 ftpd에서 디렉터리 트래버설 취약점 Packetstorm 게시물: https://packetstormsecurity.com/files/24931/alt3kx-advisories-2001.txt.html Securiteam 게시물: http://www.securiteam.com/windowsntfocus/5IP0G2040Q.html 저자 Alex Hernandez 일명 @alt3kx...

COVIDSafe-CVE-2020-12856

COVIDSafe-CVE-2020-12856: 블루투스 기반 접촉 추적 앱의 무음 페어링 문제 저자: Jim Mussared George Robotics, Alwen Tiu 호주국립대학교 호주 COVIDSafe v1.0.17 이하 접촉 추적 앱의 Android 버전 구현에서 취약점이 확인되었으며, 이는 싱가포르의 TraceTogether, 앨버타의 ABTraceTogether 등 유사한 아키텍처를 공유하는 여러 다른 접촉 추적 앱에도 영향을 미칠 수 있습니다. 이 문제는 CVE ID CVE-2020-12856로 추적됩니다. 이...

Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'updatemetadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of...

CVE-2024-54772

CVE-2024-54772 MikroTik-RouterOS 사용자 이름 열거 이 저장소는 CVE-2024-54772 에 대한 익스플로잇을 포함하며, Mikrotik 라우터에서 RouterOS 안정stable 버전 v6.43 부터 v7.17.2 까지 실행 중인 유효한 사용자 이름을 워드리스트를 사용하여 열거할 수 있습니다. 패치는 v6.49.18 및 v7.18 에서 제공됩니다. 장기long-term 릴리스의 경우 영향을 받는 버전은 v6.43.13 부터 v6.49.13 까지입니다. 다음 RouterOS 변경 로그 링크를...

telnet-CVE-2026-24061

https://github.com/SafeBreach-Labs/CVE-2026-24061/blob/main/telnetrce.py コードを理解する必要がある 2. inputを使わず、直接zmienna = ''で動作するコードを構築する コードはあらゆるデバイスと互換性がなければならないため、os.system'polecenie'のようなコマンドは使用できない 3. simple-term-menuによるGUIの追加...

CVE-2026-94297 Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation

The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on th...

CVE-2026-94297

The Media Library Organizer WordPress plugin (versions prior to 2.1.4 ) contains a vulnerability where it fails to verify if a requesting user possesses the necessary management capabilities for a target taxonomy. This flaw allows users with contributor-level access or higher to create new, publi...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.67 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform proper capability checks when saving specific fields and lacks sufficient output escaping . Th...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

EUVD-2026-82606

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454: Improper Neutralization of Input During Web Page Generation

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454

Aureus ERP through 1.6.0 contains a stored XSS in the Accounting plugin's Payment Term note field. The field is stored unsanitized and rendered as raw HTML, allowing any authenticated user with payment-term create permission to inject arbitrary JavaScript via the payment-terms endpoint. The paylo...

CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Avoid scheduling in rtasosterm. It is unsafe to use rtasbusydelay to handle a busy status from the IBM,os-term RTAS function in rtasosterm: Kernel Panic – Not Syncing: Attempted to kill init! Exitcode = 0x0000000b...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Mbed TLS before version 2.25.0 and before versions 2.16.9 LTS and 2.7.18 LTS. A NULL algorithm parameter entry resembles an array of REAL values with a size of zero; therefore, the certificate is considered valid. However, if the parameters do not match at all, then the...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This issue was addressed in the epan/dissectors/packet-lte-rrc.c file by adjusting certain append operations...