4570 matches found
PCI DSS version 4.0 – what we know so far
From September 23 - November 13, 2020, stakeholders can participate in the Request for Comments RFC on the draft of PCI Data Security Standard DSS version 4.0. This is the second RFC for the PCI DSS v4.0 draft--the first RFC was in late 2019 and that feedback was incorporated into the draft...
UBUNTU-CVE-2020-13325
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service...
PT-2020-13466 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1 Description: A vulnerability was discovered where the comment section of the issue page was not properly restricting characters, potentially resulting in a denial of service. Recommendations: For GitLab versions...
Unauthorized Access Vulnerability in Tumo Blog
Tumo Blog a blogging system. An unauthorized access vulnerability exists in Tumo Blog, which can be exploited by an attacker to perform unauthorized actions such as deleting comments from others...
CVE-2020-25751
The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago&view=comments filterpublished parameter...
PT-2020-16184
Name of the Vulnerable Software and Affected Versions paGO Commerce plugin version 2.5.9.0 for Joomla! Description The issue allows SQL Injection via the "administrator/index.php?option=com pago&view=comments" API endpoint, specifically through the filter published parameter. Recommendations For...
PT-2020-6584 · Unknown +4 · Hibernate-Core +4
Name of the Vulnerable Software and Affected Versions: hibernate-core versions prior to and including 5.4.23.Final Description: A flaw was found in the implementation of the JPA Criteria API, which can permit unsanitized literals when a literal is used in the SQL comments of the query, allowing a...
Debian DLA-2371-1 : wordpress security update
Multiple vulnerabilities were discovered in Wordpress, a popular content management framework. CVE-2019-17670 WordPress has a Server Side Request Forgery SSRF vulnerability because Windows paths are mishandled during certain validation of relative URLs. CVE-2020-4047 Authenticated users with uplo...
CVE-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
DEBIAN-CVE-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
UBUNTU-CVE-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
CVE-2020-25286
The CVE-2020-25286 issue affects WordPress core, specifically wp-includes/comment-template.php, present in WordPress versions before 5.4.2. The vulnerability allows comments from non-public posts/pages to appear in the latest comments, exposing potentially sensitive discussions. The root cause is...
CVE-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
CVE-2020-25286: Undefined Security Weakness
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
HackerOne: Team object in GraphQL disclosed private_comment
Summary: Hi Team, Some privateI think part of GraphQL reveals to us Steps To Reproduce Without authorization 1. https://hackerone.com/graphql POST: "query":"query nodeid: \"gid://hackerone/SurveyRatingItem/█████\" ... on...
EAP: field-name is not parsed in accordance to RFC7230
A flaw was discovered in JBoss EAP, where it does not process the header field-name in accordance with RFC7230. Whitespace between the header field-name and colon is processed, resulting in an HTTP response code of 200 instead of a bad request of 400...
Schneier.com is Moving
I'm switching my website software from Movable Type to Wordpress, and moving to a new host. The migration is expected to last from approximately 3 AM EST Monday until 4 PM EST Tuesday. The site will still be visible during that time, but comments will be disabled. This is to prevent any new...
Schneier.com is Moving
Im switching my website software from Movable Type to WordPress, and moving to a new host. The migration is expected to last from approximately 3 AM EST Monday until 4 PM EST Tuesday. The site will still be visible during that time, but comments will be disabled. This is to prevent any new commen...
Schneier.com is Moving
Im switching my website software from Movable Type to WordPress, and moving to a new host. The migration is expected to last from approximately 3 AM EST Monday until 4 PM EST Tuesday. The site will still be visible during that time, but comments will be disabled. This is to prevent any new commen...