6755 matches found
CVE-2021-24466
The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this coul...
CVE-2021-24380
The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values...
Cross site scripting
The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this coul...
Cross site request forgery (csrf)
The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values...
PT-2021-15286 · Pulse Secure · Pulse Connect Secure
Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A vulnerability could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter. Recommendations: For versions...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
CVE-2021-31731
A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Template/fileedit, with PHP code in the html parameter...
CVE-2021-31731
A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Template/fileedit, with PHP code in the html parameter...
Magento Commerce 授权问题漏洞
Magento Commerce is to provide a best-in-class shopping experience without the need for developer support. Magento Commerce has an authorization issue vulnerability that exists due to insufficient authorization checks. A remote administrator can bypass implemented security restrictions and gain...
Magento Commerce 安全漏洞
Magento Commerce is to provide a best-in-class shopping experience without developer support. Magento Commerce has a security vulnerability that exists due to insufficient authorization checks. A remote administrator can bypass implemented security restrictions and gain unauthorized access to the...
CVE-2021-24521
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack...
Liferay Portal and Liferay DXP have unspecified vulnerabilities (CNVD-2021-62965)
Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...
CISA and NSA Release Kubernetes Hardening Guidance
The National Security Agency NSA and CISA have released Kubernetes Hardening Guidance, a cybersecurity technical report detailing the complexities of securely managing Kubernetes—an open-source, container-orchestration system used to automate deploying, scaling, and managing containerized...
CVE-2021-20783
Cross-site request forgery CSRF vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page...
Dell EMC iDRAC9 improper authentication vulnerability
Dell EMC iDRAC9 is an integrated Dell Remote Access Controller that helps IT administrators deploy, update, monitor and maintain servers without installing any additional software.Dell EMC iDRAC9 has an improper authentication vulnerability. An attacker could use this vulnerability to gain...
Ubuntu Apport Backlink Vulnerability (CNVD-2021-57437)
Apport is a toolkit for collecting and giving feedback on error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Ubuntu Apport that stems from incorrect handling of certain information gathering operations, which can be...
Cisco Releases Security Updates
Cisco has released security updates to address multiple vulnerabilities in Intersight Virtual Appliance. An attacker could exploit these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA...
DELL EMC Repository Manager has an unspecified vulnerability
DELL EMC Repository Manager is an application within the Dell OpenManage product portfolio from Dell USA that allows IT administrators to easily manage system updates.Dell Repository Manager provides a searchable interface for creating custom software collections that are A security vulnerability...
Oracle Releases July 2021 Critical Patch Update
Oracle has released its Critical Patch Update for July 2021 to address 342 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Oracle July 2021 Critica...
Verse-O-Matic <= 4.1.1 - CSRF to Stored XSS
The plugin does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site...