Cross site scripting

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues...

CVE-2021-23130 [20210304] - Core - XSS within the feed parser library

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues...

CVE-2021-23130

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues...

CVE-2021-23130: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues...

PT-2021-15385 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.24 Description: An issue was discovered that could lead to XSS issues due to missing filtering of feed fields. Recommendations: For Joomla! versions 2.5.0 through 3.9.24, update to a version that contains a...

CVE-2021-23130

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues...

TinyTinyRSS Remote Code Execution

!/usr/bin/env python3 Exploit Title: TinyTinyRSS remote code execution Date: 21 September 2020 made public Exploit Author: Daniel Neagaru & Benjamin Nadarević Blog post: https://www.digeex.de/blog/tinytinyrss/ Software Link: https://git.tt-rss.org/fox/tt-rss Version: all before 2020-09-16 Commit...

Joomla cross-site scripting vulnerabilities

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! 2.5.0 - 3.9.24. The...

Experts Find a Way to Learn What You're Typing During Video Calls

A new attack framework aims to infer keystrokes typed by a target user at the opposite end of a video conference call by simply leveraging the video feed to correlate observable body movements to the text being typed. The research was undertaken by Mohd Sabra, and Murtuza Jadliwala from the...

feature-toggle-manager (>=0.0.1, <=0.0.2), hazard-feed (>=0.2.0, <=0.2.5) potentially affected by CVE-2020-35681 via channels (>=3.0.0, <=3.0.2)

channels PYPI version =3.0.0, =0.0.1, =0.2.0, =0.2.5 Source cves: CVE-2020-35681 Source advisory: OSV:PYSEC-2021-113...

feature-toggle-manager (>=0.0.1, <=0.0.2), hazard-feed (>=0.2.0, <=0.2.5) potentially affected by CVE-2020-35681 via channels (>=3.0.0, <=3.0.2)

channels PYPI version =3.0.0, =0.0.1, =0.2.0, =0.2.5 Source cves: CVE-2020-35681 Source advisory: MEND:CVE-2020-35681...

CVE-2021-21301 Video feed was captured while user has disabled video

Wire is an open-source collaboration platform. In Wire for iOS iPhone and iPad before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the...

CVE-2021-21017

creationtimestamp| type| source ---|---|--- 2021-02-10 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=551 2021-02-11 22:48:01+00:00| seen| https://t.me/cibsecurity/23482 2021-02-15 11:00:19+00:00| seen| https://t.me/CyberSecurityTechnologies/2708 2021-11-08 08:58:16+00:00...

CVE-2021-20016

creationtimestamp| type| source ---|---|--- 2021-02-04 12:34:03+00:00| seen| https://t.me/cibsecurity/23046 2021-04-30 12:25:17+00:00| exploited| https://t.me/truesecator/1668 2021-05-24 09:56:40+00:00| seen| MISP/d81c3a80-018d-413d-9f11-59aa0c67e761 2021-06-07 13:36:14+00:00| seen|...

CVE-2020-29557

creationtimestamp| type| source ---|---|--- 2021-01-29 23:25:09+00:00| seen| https://t.me/cibsecurity/22855 2021-11-08 08:58:17+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-24 07:05:52+00:00| seen|...

ADT Security Camera Flaws Open Homes to Eavesdropping

UPDATE Researchers have publicly disclosed security flaws found in ADT-owned LifeShield security cameras, which, if exploited, could have allowed a local attacker to eavesdrop on victims’ conversations or tap into a live video feed. The LifeShield brand is owned by security giant ADT. Specificall...

Code injection

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278 Risk of code injection in RSSHub

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278

RSSHub is affected by a code-injection vulnerability in which certain routes use eval or the Function constructor, allowing unsafe code to be injected by a target site. The root cause is unsafe dynamic code evaluation in specific routes. The fix (version 7f1c430) temporarily removes the problemat...

CVE-2021-1782

creationtimestamp| type| source ---|---|--- 2021-01-26 19:50:53+00:00| exploited| https://t.me/alexmakus/3855 2021-01-27 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=543 2021-02-15 06:56:29+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2694...