Sassy Social Share 3.3.23 - Missing Access Controls to PHP Object Injection

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wpajaxheateorsssimportconfig AJAX action due to a missing capability check in the importconfig function found in the /admin/class-sassy-social-share-admin.php file along with the implementation...

Simplifying the complex: Introducing Privacy Management for Microsoft 365

The data privacy regulation landscape is more complex than ever. With new laws emerging in countries like China and India, shifts in Europe and the United Kingdom, and currently 26 different laws across the United States, staying ahead of regulations can feel impossible. But this work is...

Simplifying the complex: Introducing Privacy Management for Microsoft 365

The data privacy regulation landscape is more complex than ever. With new laws emerging in countries like China and India, shifts in Europe and the United Kingdom, and currently 26 different laws across the United States, staying ahead of regulations can feel impossible. But this work is...

Nodejs Core 环境问题漏洞

Nodejs Core is a core module compiled into Nodejs from the OpenJS Openjs Foundation. The module provides underlying TCP, HTTP, DNS, filesystem, subprocessing, and other functionality support for Nodejs. An environmental issue vulnerability exists in Nodejs Core that stems from an attacker being...

GitOops - All Paths Lead To Clouds

GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls. It works by mapping relationships between a GitHub organization and its CI/CD jobs and environment variables...

CVE-2021-20584

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397...

CVE-2021-20375

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

CVE-2021-20375

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

Improper access control

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

CVE-2021-20584

CVE-2021-20584 affects IBM Sterling File Gateway. Affected versions range from 2.2.0.0–6.1.1.0 and are vulnerable to arbitrary file upload due to improper access controls. Remote attackers could upload arbitrary files via the web/UI. Remediation: upgrade to 6.1.1.0 or apply the designated fixes (...

CVE-2021-20584

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397...

CVE-2021-20375

CVE-2021-20375 affects IBM Sterling File Gateway versions 2.2.0.0 through 6.1.1.0. The issue is improper access controls allowing an authenticated user to intercept and replace a message sent by another user. IBM’s remediation/patch guidance (per IBM Security Bulletin) provides fixes by product v...

Teddy 跨站脚本漏洞

Teddy is an easy-to-read, easy-to-learn template language. A security vulnerability exists in teddy that stems from the lack of effective permission and access control measures on a networked system or product...

Sophos HitmanPro 安全漏洞

Sophos HitmanPro is an excellent multi-engine cloud anti-virus scanner from Sophos UK.Sophos HitmanPro suffers from a security vulnerability that stems from a lack of authentication, access control, permission management and other security measures in the network system or product, which could be...

CVE-2021-34782

A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be restricted. The attacker must have valid device credentials. This vulnerability is due to improper access controls on API endpoints. An...

CVE-2021-34758

A vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, local attacker to corrupt a shared memory segment, resulting in a denial of service DoS condition. This vulnerability is due to insufficient...

Design/Logic Flaw

A vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, local attacker to corrupt a shared memory segment, resulting in a denial of service DoS condition. This vulnerability is due to insufficient...

Improper access control

A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be restricted. The attacker must have valid device credentials. This vulnerability is due to improper access controls on API endpoints. An...

CVE-2021-34758 Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerability

A vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, local attacker to corrupt a shared memory segment, resulting in a denial of service DoS condition. This vulnerability is due to insufficient...

CVE-2021-34758 Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerability

A vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, local attacker to corrupt a shared memory segment, resulting in a denial of service DoS condition. This vulnerability is due to insufficient...