getsimplecms 跨站脚本漏洞

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/snippets.php in GetSimple CMS version 3.4.0a. An attacker can exploit this vulnerability via Add Snippet and Save snippets to conduct cross-site...

CVE-2020-18648

Cross Site Request Forgery CSRF in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component "JuQingCMSv1.0/admin/index.php?c=administrator&a=add"...

CVE-2020-20467

White Shark System WSS 1.3.2 is vulnerable to sensitive information disclosure via defaulttaskadd.php, remote attackers can exploit the vulnerability to create a task...

Sign-up Sheets < 1.0.14 - Authenticated CSV Injection

The plugin does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue Go to the Sign-up Sheets-- Add New. Enter the following CSV Injection payload in the field "Title", "Details" and "Task" click on save button. =cmd|' /C...

PT-2021-10493 · Unknown · White Shark System

Name of the Vulnerable Software and Affected Versions: White Shark System WSS version 1.3.2 Description: The issue allows remote attackers to exploit the vulnerability and create a task, leading to sensitive information disclosure via the default task add.php endpoint. The default task add.php...

[eBook] 7 Signs You Might Need a New Detection and Response Tool

It's natural to get complacent with the status quo when things seem to be working. The familiar is comfortable, and even if something better comes along, it brings with it many unknowns. In cybersecurity, this tendency is countered by the fast pace of innovation and how quickly technology becomes...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.504.2.el7 - md/raid1: properly indicate failure when ending a failed write request Paul Clements Orabug: 32887159 - video: hypervfb: Add ratelimit on error message Michael Kelley Orabug: 32856879 - Drivers: hv: vmbus: Initialize unloadevent statically Andrea Parri Microsoft Orabug:...

Unbreakable Enterprise kernel security update

5.4.17-2102.202.5 - sctp: delay autoasconf init until binding the first addr Xin Long Orabug: 32907967 CVE-2021-23133 CVE-2021-23133 - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860491 CVE-2021-31916 - uek-rpm: update kABI lists for the new symbols Saeed...

CVE-2020-18265

Cross Site Request Forgery CSRF in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=actaddmember"...

UBUNTU-CVE-2021-3573

A use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...

YzmCMS YzmCMS 跨站请求伪造漏洞

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 5.8 version of the existence of cross-site request forgery vulnerability, the attacker can be member/member/add.html through the use of this vulnerability to add...

CVE-2020-35514

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShif...

PT-2024-11328 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a resource leak in the Linux kernel's megaraid sas driver. When the scsi add host or megasas start aen function fails during the PCI device probe, the driver do...

UBUNTU-CVE-2020-22039

A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inaviaddientry function...

CVE-2021-32540

Hundred Plus 101EIP system (cloud-based office platform) contains a stored XSS vulnerability in its bulletin feature due to lack of input filtering of special characters. The issue allows authenticated users to inject JavaScript, leading to stored XSS. Affected component: 101EIP bulletin/announce...

Hundred Plus 101EIP 跨站脚本漏洞

The Hundred Plus 101EIP system is a cloud-based office platform from Taiwan-based Hundred Plus Corporation Hundred Plus that has been optimized by gathering the experience of many enterprises. 101EIP suffers from a cross-site scripting vulnerability that stems from the calendar add event feature...

CVE-2021-25935

In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the...

systemd security, bug fix, and enhancement update

239-45.0.1 - backport upstream pstore tmpfiles patch Orabug: 31420486 - udev rules: fix memory hot add and remove Orabug: 31310273 - fix to enable systemd-pstore.service Orabug: 30951066 - journal: change support URL shown in the catalog entries Orabug: 30853009 - fix to generate...

GNOME security, bug fix, and enhancement update

accountsservice 0.6.55-1 - Rebase to 0.6.55 Resolves: 1846376 atkmm 2.24.2-7 - Rebuild for annobin fixes - Resolves: rhbz1703969 cairomm 1.12.0-8 - Rebuild for the annobin fixes - Resolves: rhbz1703971 chrome-gnome-shell 10.1-7 - Disable updates support Resolves: 1802105 dleyna-core 0.6.0-3 - Don...

Acronis True Image 安全漏洞

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. Acronis True Image 2020 version 24.5.22510 contains a security vulnerability that could be exploited by an attacker to add arbitrary malicious executables to a whitelist or even exclude an entire dri...