Design/Logic Flaw

OpenIAM before 4.2.0.3 allows XSS in the Add New User feature...

CVE-2020-13418

CVE-2020-13418 affects OpenIAM prior to 4.2.0.3, where the vulnerability is a cross-site scripting (XSS) issue in the Add New User feature. Multiple connected sources (NVD/NVDC CNVD/CNNVD) confirm the impact as XSS in that feature and version range, but they do not provide exploit details, affect...

CVE-2021-30164

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API...

Redmine 安全漏洞

Redmine is a set of open source Web-based project management and defect tracking tools . The product provides project management , issue tracking and role-based access control and other features . A security vulnerability exists in Redmine before 4.0.8 and 4.1.x before 4.1.2 that allows an attack...

The vulnerability of the `dirvote_add_signatures_to_pending_consensus()` function in the Tor browser, related to the lack of use of the `assert()` function, allows a violator to trigger a service failure.

The vulnerability of the dirvoteaddsignaturestopendingconsensus function in the Tor browser is related to the lack of use of the assert function. Exploiting this vulnerability allows a malicious actor to trigger a service failure remotely...

Github OpenIAM 跨站脚本漏洞

OpenIAM is a fully integrated identity and access management platform. A cross-site scripting vulnerability exists in the "Add New User" feature in OpenIAM versions prior to 4.2.0.3. No details of the vulnerability are available at this time...

June 1, 2021, update for Office 2013 (KB5001937)

June 1, 2021, update for Office 2013 KB5001937 This article describes update 5001937 for Microsoft Office 2013 that was released on June 1, 2021. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft Installe...

SharpGPOAbuse - Tool To Take Advantage Of A User'S Edit Rights On A Group Policy Object (GPO) In Order To Compromise The Objects That Are Controlled By That GPO

SharpGPOAbuse is a .NET application written in C that can be used to take advantage of a user's edit rights on a Group Policy Object GPO in order to compromise the objects that are controlled by that GPO. More details can be found at the following blog post:...

CVE-2021-23276

Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base...

CVE-2021-29663

CourseMS aka Course Registration Management System 2.1 is affected by cross-site scripting XSS. When an attacker with access to an Admin account creates a Job Title in the Site area aka the admin/addjobs.php name parameter, they can insert an XSS payload. This payload will execute whenever anyone...

CVE-2021-28935

CMS Made Simple CMSMS 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin My Preferences Title field...

Mapplic and Mapplic Lite - SSRF to Stored Cross-Site Scripting (XSS)

The Mapplic Lite alert/XSS/...

PT-2021-17773 · Grafana +2 · Grafana Enterprise +3

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 6.x through 6.7.5 Grafana Enterprise versions 7.x through 7.3.9 Grafana Enterprise versions 7.4.x through 7.4.4 Description: The team sync HTTP API in Grafana Enterprise presents an Incorrect Access Control issue. ...

The vulnerability in the `default_add_message` function of the `read-catalog.c` file in the GNU project’s library, related to the internationalization of Gettext, allows a hacker to repeatedly release a memory area, enabling them to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in the defaultaddmessage function of the read-catalog.c file in the GNU project’s library is related to the repeated release of a memory area. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and even cause...

The vulnerability of the arlib_add_symbols() function in the arlib.c file of the ELF object processing utility suite Elfutils, related to division by zero, allows a malicious actor to cause a service failure.

The vulnerability of the arlibaddsymbols function in the arlib.c file of the ELF object processing utility Elfutils is related to incorrect handling of zero shentsize. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

[SECURITY] Fedora 34 Update: ksshaskpass-5.21.3-1.fc34

A ssh-add helper that uses kwallet and kpassworddialog...

VestaCP 0.9.8 - 'v_interface' Add IP Stored XSS

Title: VestaCP 0.9.8 - 'vinterface' Add IP Stored XSS Date: 07.03.2021 Author: Numan Türle Vendor Homepage: https://vestacp.com Software Link: https://myvestacp.com alert1&vshared=on&vowner=admin&vname=&vnat=&ok=Add...

CVE-2021-27695

Multiple stored cross-site scripting XSS vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters...

Cross site scripting

Multiple stored cross-site scripting XSS vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters...

CVE-2021-27695

Multiple stored cross-site scripting XSS vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters...