2477 matches found
Design/Logic Flaw
In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...
CVE-2021-36170
An information disclosure vulnerability CWE-200 in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext...
Wordpress JS Jobs Manager 1.1.7 Plugin - Unauthenticated Plugin Install/Activation Vulnerability
Exploit Title: Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation Google Dork: inurl:/wp-content/plugins/js-jobs/ Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/js-jobs/ Version: spacehen www.github.com/spacehen" def printusage: print"Usage...
Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation
Exploit Title: Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation Google Dork: inurl:/wp-content/plugins/js-jobs/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/js-jobs/ Version: spacehen www.github.com/spacehen" def...
WordPress JS Jobs Manager 1.1.7 Authorization Bypass
Exploit Title: Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation Google Dork: inurl:/wp-content/plugins/js-jobs/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/js-jobs/ Version: spacehen www.github.com/spacehen" def...
JS Job Manager < 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation
The jsjobsajax AJAX action of the plugin available to both authenticated and unauthenticated users does not have proper authorisation and CSRF checks, in particular when using the installPluginFromAjax and activatePluginFromAjax, which could allow unauthenticated attackers to install arbitrary...
JS Job Manager < 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation
The jsjobsajax AJAX action of the plugin available to both authenticated and unauthenticated users does not have proper authorisation and CSRF checks, in particular when using the installPluginFromAjax and activatePluginFromAjax, which could allow unauthenticated attackers to install arbitrary...
Citrix IME might not be set as active IME automatically while using Local IME in Chinese, Japanese, or Korean
Citrix IME might not be set as active IME automatically at the VDA sidewhile using Local IME in Chinese, Japanese, or Korean. For example, when users enable the keyboard layoutoptions of dynamic sync and Local IME and start a VDA session with Japanese IME, the IME at the VDA side should be switch...
September 27, 2021—KB5005619 (OS Build 20348.261) Preview
None None...
Security Bulletin: Vulnerability in systemd affects Power Hardware Management Console (CVE-2019-6454)
Summary The systemd is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE Vulnerability Details CVEID: CVE-2019-6454 DESCRIPTION: The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provid...
The vulnerability of the `match.path` property in the NetworkManager network connection management software, which stems from insufficient validation of input data, allows a hacker to trigger a service failure.
The vulnerability of the match.path property in the NetworkManager network connection management software is related to improper handling of the installation of the match.path property and the activation of the profile. Exploiting this vulnerability can allow an attacker to cause service failures...
CVE-2021-41077
The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...
Design/Logic Flaw
The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...
CVE-2021-41077
The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...
CVE-2021-38325
The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...
CVE-2021-38325 User Activation Email <= 1.3.0 Reflected Cross-Site Scripting
The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...
CVE-2021-38325
CVE-2021-38325 affects the WordPress plugin User Activation Email (versions
WordPress 插件跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin User Activation Email 1.3 and earlier versions, whic...