CVE-2021-34623

A vulnerability in the image uploader component found in the /src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3...

VulnCheck KEV: CVE-2021-34622

A vulnerability in the user profile update component found in the /src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3...

Asken Diet 输入验证错误漏洞

Asken Diet is a health and diet calorie counting app from Asken Japan. Gets the user's weight goals and health data and creates programs to help guide the user to become healthier. A security vulnerability exists in Asken Diet versions v.3.0.0 through v.4.2.x that stems from incorrect authorizati...

PT-2021-14189 · あすけんダイエット · あすけんダイエット

Name of the Vulnerable Software and Affected Versions: あすけんダイエット asken diet versions 3.0.0 through 4.2.x Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access an arbitrary website via the vulnerable...

PT-2021-7217 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.4 Description: The issue is related to the reuse of CSRF tokens by a malicious user, as no cleanup is done on these tokens on Windows servers. This can allow a remote attacker to perform a CSRF attack...

GHSA-PW59-4QGF-JXR8 Cache Manipulation Attack in Apache Traffic Control

When ORT now via atstccfg generates ipallow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are...

PT-2021-20234

Name of the Vulnerable Software and Affected Versions: trim-newlines versions 3.0.0 and earlier, 4.x before 4.0.1 Description: The issue is related to regular expression denial-of-service ReDoS for the .end method. This can cause a denial-of-service condition. Recommendations: For versions 3.0.0...

Joomla! cross-site request forgery vulnerability (CNVD-2021-38296)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in combanners and comsysinfo in...

Cross site request forgery (csrf)

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint...

F5 NGINX Controller 安全漏洞

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller due to incorrect default permissions that allow local users ...

Joomla! 跨站脚本漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! versions 3.0.0 through...

Joomla! 跨站请求伪造漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site request forgery vulnerability exists in combanners and comsysinfo in...

NGINX控制器 安全特征问题漏洞

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security signature issue vulnerability exists in F5 NGINX Controller that allows local users to bypass implemente...

Podman Origin Validation Error

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 including from remote hosts. This impacts containerized applications that trust localhost 127.0.01 connections by default and do not require authentication. This issue affects Podman versions from 1.8.0...

GHSA-GRH6-Q6M2-RH72 Podman Origin Validation Error

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 including from remote hosts. This impacts containerized applications that trust localhost 127.0.01 connections by default and do not require authentication. This issue affects Podman versions from 1.8.0...

Vaadin flow 安全漏洞

Vaadin flow is a software application, a Java framework for the Vaadin platform, for building modern websites that look good, perform well, and keep you and your users happy. A security vulnerability exists in Vaadin flow that allows an attacker to guess a security token via a timing attack. The...

Information disclosure

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

GHSA-RJWW-2X8V-M9V9 Potential sensitive data exposure in applications using Vaadin 15

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController - https://vaadin.com/security/cve-2020-36319...

PT-2021-12003 · Vaadin · Com.Vaadin:Flow-Server +1

Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin versions 15.0.0 through 15.0.4 Description: The issue is related to an insecure configuration of the default ObjectMapper in the affected software. This may expose sensitive data if t...

Joomla! cross-site scripting vulnerability (CNVD-2021-30598)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! versions 3.0.0 through...