L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers

Overview Layer-2 L2 network security controls provided by various devices, such as switches, routers, and operating systems, can be bypassed by stacking Ethernet protocol headers. An attacker can send crafted packets through vulnerable devices to cause Denial-of-service DoS or to perform a...

Security Bulletin: IBM Security Verify Information Queue uses a Wire Schema jar with multiple vulnerabilities (CVE-2020-27853, CVE-2021-41093)

Summary The connect image in IBM Security Verify Information Queue ISIQ v10.0.2 uses an older version of the Wire Schema jar file that is vulnerable to remote attackers. ISIQ v10.0.3 upgraded its connect image to include a newer Wire Schema jar that remediates the vulnerabilities. CVE-2020-27853,...

CVE-2022-27853

creationtimestamp| type| source ---|---|--- 2022-04-18 20:29:30+00:00| seen| https://t.me/cibsecurity/41033...

CVE-2022-27853

Authenticated author or higher role Stored Cross-Site Scripting XSS in Contest Gallery WordPress plugin = 13.1.0.9...

CVE-2022-27853 WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated author or higher role Stored Cross-Site Scripting XSS in Contest Gallery WordPress plugin = 13.1.0.9...

CVE-2022-27853

CVE-2022-27853 is an authenticated stored XSS vulnerability in the WordPress plugin Contest Gallery up to version 13.1.0.9. Affected component: Contest Gallery plugin for WordPress; root cause details are not provided beyond the XSS label in the CVE record. The connected sources corroborate the v...

CVE-2020-27853

Wire before 2020-10-16 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a format string. This affects Wire AVS Audio, Video, and Signaling 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, an...

CVE-2020-27853

Wire before 2020-10-16 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a format string. This affects Wire AVS Audio, Video, and Signaling 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, an...

CVE-2020-27853

CVE-2020-27853 is a format-string vulnerability in Wire’s peerflow/sdp.c (sdp_media_set_lattr). It affects Wire AVS 5.3–6.x before 6.4 and Wire Secure Messenger apps on Android/iOS (before the listed versions). Remote attackers could cause a denial of service (crash) or execute arbitrary code; im...

Joomla! Mambo Component com_detail - id SQL Injection

Joomla! Mambo Component comdetail - id SQL Injection source: https://www.securityfocus.com/bid/27853/info The Joomla! and Mambo 'comdetail' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting...