PT-2021-20072 · Apache · Apache Apisix Dashboard

Name of the Vulnerable Software and Affected Versions: Apache APISIX Dashboard version 2.6 Description: The issue arises from a combination of factors, including a change in the default listen host to 0.0.0.0 to facilitate external network access, the use of a risky function for IP acquisition in...

Security Bulletin: IBM QRadar Advisor With Watson App for IBM QRadar SIEM is vulnerable to information exposure (CVE-2021-20380)

Summary IBM QRadar Advisor with Watson App for IBM QRadar SIEM could allow an unauthorized attacker to obtain sensitive information that could aid in further attacks against the system. Vulnerability Details CVEID: CVE-2021-20380 DESCRIPTION: IBM QRadar could allow a remote user to obtain sensiti...

CVE-2021-32305

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter...

websvn 操作系统命令注入漏洞

websvn is a software application. An online Subversion repository viewer. A security vulnerability exists in WebSVN versions prior to 2.6.1 that allows remote attackers to execute arbitrary commands via shell metacharacters in search parameters...

Potential XSS injection in the newsletter conditions field

Impact An employee can inject javascript in the newsletter condition field that will then be executed on the front office Patches The issue has been fixed in 2.6.1...

GHSA-VWFX-HH3W-FJ99 Potential XSS injection in the newsletter conditions field

Impact An employee can inject javascript in the newsletter condition field that will then be executed on the front office Patches The issue has been fixed in 2.6.1...

CVE-2021-21418

psemailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1...

CVE-2021-21337

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...

CVE-2021-21337

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...

PYSEC-2021-45

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...

CVE-2021-21337

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...

PYSEC-2021-45

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...

Open redirect

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...

GHSA-P44J-XRQG-4XRR URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

Impact What kind of vulnerability is it? Who is impacted? Open redirect vulnerability - a maliciously crafted link to the login form and login functionality could redirect the browser to a different website. Patches Has the problem been patched? What versions should users upgrade to? The problem...

CVE-2020-24393

TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack...

TweetStream Trust Management Issue Vulnerability

Steve Agalloco TweetStream is an application from Steve Agallocoe Steve Agalloco, USA. Provides TweetStream provides simple Ruby access to Twitter's Streaming API. A vulnerability exists in TweetStream for trust management issues. The vulnerability stems from a failure to perform security checks ...

WordPress ListingPro theme <= 2.6 - Unauthenticated Sensitive Data Disclosure (Usernames, Emails etc) vulnerability

Unauthenticated Sensitive Data Disclosure usernames, emails, other data vulnerability found by Jerome Bruandet NinTechNet in WordPress ListingPro theme versions = 2.6. Solution Update the WordPress ListingPro theme to the latest available version at least 2.6.1...

Rukovoditel 2.6.1 Cross Site Request Forgery

Exploit Title: Rukovoditel 2.6.1 - Cross-Site Request Forgery Change password Date: 2020-12-14 Exploit Author: KeopssGroup0day,Inc Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://www.rukovoditel.net/download.php Version: v2.6.1 Tested on: Kali Linux...

Rukovoditel 2.6.1 - Cross-Site Request Forgery (Change password)

Exploit Title: Rukovoditel 2.6.1 - Cross-Site Request Forgery Change password Date: 2020-12-14 Exploit Author: KeopssGroup0day,Inc Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://www.rukovoditel.net/download.php Version: v2.6.1 Tested on: Kali Linux...

jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin

A flaw was found in the Matrix Authorization Strategy Plugin version 2.6.1 and prior. User names are not escaped in the permission table which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure, Job/Configure, or Overall/Administer permissions fo...