RHEL 7 : xorg-x11-server (RHSA-2022:0003)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0003 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical use...

WordPress Contact Form 7 Skins plugin <= 2.5.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Contact Form 7 Skins plugin versions = 2.5.0. Solution Update the WordPress Contact Form 7 Skins plugin to the latest available version at least 2.5.1...

TRIGONE Remote System Monitor 3.61 Unquoted Service Path

Exploit Title: TRIGONE Remote System Monitor 3.61 Unquoted Service Path Discovery by: Yehia Elghaly Date: 30-12-2021 Vendor Homepage: https://www.trigonesoft.com/ Software Link: https://www.trigonesoft.com/download/RemoteSystemmonitorServer3.61x86Setup.exe Tested Version: 3.61 Vulnerability Type:...

Microsoft Windows Explorer Preview Pane Security Bypass Vulnerability

Previewing a WMA/WMV media format on Windows Explorer through its Preview Pane causes embedded URLs to be automatically opened in the default browser without displaying any prompt. Exploit Title: Windows Explorer Preview Pane WMV/WMA media Automatic URI Opening Vulnerability Exploit Author: Eduar...

PT-2021-10556 · Qibosoft · Qibosoft

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: The issue allows attackers to arbitrarily delete files through the /admin/index.php?lfj=mysql&action=del endpoint. The action parameter is used with the value del to perform the deletion. Recommendations: For...

FreeBSD : OpenSearch -- Log4Shell (b0f49cb9-6736-11ec-9eea-589cfc007716)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b0f49cb9-6736-11ec-9eea-589cfc007716 advisory. - It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain...

SUSE: Security Advisory (SUSE-SU-2021:4186-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-102388)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Contact Form 7 Database Addon CFDB7...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318

CVE-2021-20318 concerns the HornetQ component of Artemis in Red Hat JBoss EAP 7. The issue is an incomplete fix for CVE-2016-4978 in the HornetQ library, exposed in EAP 7’s Artemis/HornetQ stack. This can allow a remote attacker to execute arbitrary code via a JMS ObjectMessage when interacting w...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

RHEL 7 : rh-maven36-log4j12 (RHSA-2021:5269)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:5269 advisory. Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: log4j: Remote code execution in Log4j 1....

CVE-2021-36886

Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...

Cross site scripting

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...

CVE-2021-36886

CVE-2021-36886 affects the WordPress plugin Contact Form 7 Database Addon (CFDB7) versions up to 1.2.5.9. Root cause is CSRF due to lack of token validation, enabling unauthorized actions when a logged-in user visits a malicious page. Impact is CSRF risk on sites using CFDB7

CVE-2021-36885

CFDB7 (Contact Form 7 Database Addon) WordPress plugin versions

PT-2021-21395 · WordPress · Contact Form 7 Database Addon

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1 Description: The issue is related to an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. Recommendations: For versions = 1.2.6.1, update to a version high...

PT-2021-21396 · WordPress · Contact Form 7 Database Addon – Cfdb7

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9 Description: A Cross-Site Request Forgery CSRF issue was found in the Contact Form 7 Database Addon – CFDB7 WordPress plugin. This type of issue allows an attacker to...

WordPress 插件跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Contact Form 7 Database...