WordPress All in One SEO Pack Plugin 4.0.0 - 4.1.5.2 Privilege Escalation Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress All in One SEO Pack Plugin 4.1.3.1 - 4.1.5.2 SQLi Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in modesensepage if the 'page' argument was set to MODEPAGEALLS 0x3f. A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service conditio...

GHSA-G54H-M393-CPWQ devices resource list treated as a blacklist by default

Impact Contrary to the OCI runtime specification, runc's implementation of the linux.resources.devices list was a black-list by default. This means that users who created their own config.json objects and didn't prefix a deny-all rule "allow": false, "permissions": "rwm" or equivalent were not...

Command injection

OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.236.9Vdevt2homekitRF2.0.19s2kvsABODE oz...

PT-2021-12710

Name of the Vulnerable Software and Affected Versions: Abode iota All-In-One Security Kit versions prior to 1.0.2.23 6.9V dev t2 homekit RF 2.0.19 s2 kvsABODE oz. Description: The issue is an OS Command Injection vulnerability in the wirelessConnect handler of the Abode iota All-In-One Security...

CVE-2020-8105: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.236.9Vdevt2homekitRF2.0.19s2kvsABODE oz...

UBUNTU-CVE-2021-23450

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function...

CVE-2021-23450

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function...

PT-2021-23428

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 before patch 3 Description An authenticated SQL injection issue in the calendar search function allows an attacker to read data from all tables of the database via the provider id parameter, as demonstrated by the...

GHSA-VXR4-RXW7-G7V6 Prototype Pollution in comb

All versions of package comb are vulnerable to Prototype Pollution via the deepMerge function...

wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users

A flaw was found in Wildfly. An incorrect JBOSSLOCALUSER challenge location when using the elytron configuration may lead to JBOSSLOCALUSER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability...

WordPress plugin path traversal vulnerability (CNVD-2021-102395)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A path traversal vulnerability exists in the WordPress...

All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation

The plugin is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like...

WordPress All in One SEO plugin <= 4.1.5.2 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Marc Montpas in WordPress All in One SEO plugin versions = 4.1.5.2. Solution Update the WordPress All in One SEO plugin to the latest available version at least 4.1.5.3...

PT-2021-6410 · Siemens · Syngo Fastview

Name of the Vulnerable Software and Affected Versions: syngo fastView All versions Description: A vulnerability has been identified in the affected application, which lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds write past the end of ...

CVE-2021-24970

The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue...

CVE-2021-24970 All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion

The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue...

CVE-2021-24970

The CVE-2021-24970 entry concerns the WordPress All-In-One Video Gallery plugin before version 2.5.0, where the admin dashboard uses a tab parameter in a require statement without proper sanitization/validation, causing a Local File Inclusion (LFI). Public sources in connected documents confirm t...

PT-2021-16388

Name of the Vulnerable Software and Affected Versions: All-in-One Video Gallery WordPress plugin versions prior to 2.5.0 Description: The issue arises from the lack of sanitization and validation of the tab parameter, which is used in a require statement within the admin dashboard. This leads to ...