Command injection

The Telus Wi-Fi Hub PRV65B444A-S-TS with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters passed to tr69cmd.cgi. A remote attacker connected to the router's LAN and authenticated with a super user account, or using a bypass...

CVE-2021-20122

CVE-2021-20122 affects Telus Wi-Fi Hub (PRV65B444A-S-TS) firmware 3.00.20. It is an authenticated command-injection vulnerability in multiple parameters passed to tr69_cmd.cgi. An attacker who is connected to the LAN and authenticated with a super user account, or who exploits a bypass authentica...

PT-2021-13784

Name of the Vulnerable Software and Affected Versions: Telus Wi-Fi Hub PRV65B444A-S-TS version 3.00.20 Description: The issue allows an authenticated user with physical access to the device to read arbitrary files from the device. This can be achieved by preparing and connecting a specially...

CVE-2021-20121: Undefined Security Weakness

The Telus Wi-Fi Hub PRV65B444A-S-TS with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. An authenticated user with physical access to the device can read arbitrary files from the device by preparing and connecting a specially prepared USB drive to the device, and...

PT-2021-10691

Name of the Vulnerable Software and Affected Versions: ThinkPHP50-CMS version 1.0 Description: The issue is related to a remote code execution RCE vulnerability in the component /public/?s=captcha. Recommendations: For ThinkPHP50-CMS version 1.0, as a temporary workaround, consider disabling the...

CVE-2020-21865: Undefined Security Weakness

ThinkPHP50-CMS v1.0 contains a remote code execution RCE vulnerability in the component /public/?s=captcha...

PT-2021-10655

Name of the Vulnerable Software and Affected Versions: XYHCMS version 3.6 Description: The issue is related to a stored cross-site scripting XSS vulnerability. It affects the component xyhai.php?s=/Link/index. Recommendations: For XYHCMS version 3.6, update to a version that includes a fix for th...

CVE-2020-21656: Improper Neutralization of Input During Web Page Generation

XYHCMS v3.6 contains a stored cross-site scripting XSS vulnerability in the component xyhai.php?s=/Link/index...

CVE-2021-24676

The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24679

The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...

PT-2021-16187

Name of the Vulnerable Software and Affected Versions Better Find and Replace WordPress plugin versions prior to 1.2.9 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the s GET parameter is not properly escaped before being outputted back in the All...

PT-2021-16190

Name of the Vulnerable Software and Affected Versions Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin versions prior to 1.6.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the s GET parameter is not properly escaped before being...

CVE-2021-24679: Improper Neutralization of Input During Web Page Generation

The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24676: Improper Neutralization of Input During Web Page Generation

The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...

Fedora: Security Advisory for curl (FEDORA-2021-fc96a3a749)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

S-CMS Access Control Error Vulnerability

S-CMS is a PHP and MySQL-based content management system CMS from S-CMS, a Chinese company. S-CMS suffers from an access control error vulnerability, which originates from an unauthorized access vulnerability in CMS Enterprise Website Construction System 5.0. An attacker can use this vulnerabilit...

Fedora: Security Advisory for gifsicle (FEDORA-2021-c351011066)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-33701

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 20111620, 20111640, 20111700, 20111710, 20111730, 710, 20111731, 710, 20111752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain...

CVE-2021-33701

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 20111620, 20111640, 20111700, 20111710, 20111730, 710, 20111731, 710, 20111752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain...

Sql injection

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 20111620, 20111640, 20111700, 20111710, 20111730, 710, 20111731, 710, 20111752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain...