6801 matches found
Microsoft Digital Defense Report shares new insights on nation-state attacks
Microsoft is proud to promote Cybersecurity Awareness Month as part of our ongoing commitment to security for all. Year-round, Microsoft tracks nation-state threat activities to help protect organizations and individuals from these advanced persistent actors. We’re constantly improving our...
GHSA-4MVJ-RQ4V-2FXW Prototype Pollution in x-assign
This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object...
all-electronics.de Cross Site Scripting vulnerability OBB-2189278
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-23452
This affects all versions of package x-assign. The global proto object can be polluted using the proto object...
CVE-2021-35550
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated...
CVE-2021-37136
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data which affects the allocation size used during decompression. All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack...
bristolallheart.com Improper Access Control vulnerability OBB-2182567
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2021-30116
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10.4 through v5.10.70 Description A potential issue exists in the RDMA/cma component, specifically in the rdma cma listen on all function, where a listener leak can occur upon failure. The actual impact and likelihood ...
PT-2021-30192
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.11 through v5.14.9 Description A potential issue exists in the RDMA/cma component, specifically in the rdma cma listen on all function, where a listener leak can occur upon failure. The actual impact and attack...
PT-2021-26121
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10.4 through v5.10.70 Description A potential issue exists in the RDMA/cma component, specifically in the rdma cma listen on all function, where a listener leak can occur upon failure. The actual impact and attack...
Verizon’s Visible Wireless Carrier Confirms Credential-Stuffing Attack
On Wednesday, Verizon’s Visible – an all-digital, uber-cheap wireless carrier – confirmed what customers have been complaining about on Reddit and Twitter all week: They lost control of their accounts; had their passwords and shipping addresses changed; and some got stuck with bills for pricey ne...
Config Handler 安全漏洞
Config Handler is an open source package. It is used for loading configurations, deep merging packages, global, and environments. Config Handler has a security vulnerability that stems from the fact that all versions of the package configuration handler are susceptible to prototype contamination...
CVE-2021-41918
webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the...
CVE-2021-41918
webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Path traversal and file disclosure vulnerabilit...
airportgoldentuliphotel.com Cross Site Scripting vulnerability OBB-2158377
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
WP All Export < 1.3.1 - Admin+ Stored Cross-Site Scripting
The plugin does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed 1. Create a new export via "New Export" page. 2. Go to "Manage Exports...
WP All Export < 1.3.1 - Admin+ Stored Cross-Site Scripting
The plugin does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC 1. Create a new export via "New Export" page. 2. Go to "Manage...
PT-2021-16190
Name of the Vulnerable Software and Affected Versions Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin versions prior to 1.6.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the s GET parameter is not properly escaped before being...
PT-2021-16187
Name of the Vulnerable Software and Affected Versions Better Find and Replace WordPress plugin versions prior to 1.2.9 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the s GET parameter is not properly escaped before being outputted back in the All...