CVE-2021-23261

Crafter CMS is affected by a vulnerability where an authenticated administrator can override the system configuration file , enabling a denial of service . The description and related entries (CVE-2021-23261, Crafter CMS CNVD/CNNVD references) confirm the root cause as a file overwrite/authentica...

Mozilla Releases Security Updates for Network Security Services

Mozilla has released security updates to address a vulnerability in Network Security Services NSS. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review the Mozilla Security Advisory for NSS and apply the necessary...

PT-2021-15421

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description The issue allows authenticated administrators to override the system configuration file, which can cause a denial of service. Recommendations At the moment, there is no information about a...

CVE-2021-23262: Improper Control of Dynamically-Managed Code Resources

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE...

[SECURITY] Fedora 33 Update: remmina-1.4.21-1.fc33

Remmina is a remote desktop client written in GTK+, aiming to be useful for system administrators and travelers, who need to work with lots of remote computers in front of either large monitors or tiny net-books. Remmina supports multiple network protocols in an integrated and consistent user...

[SECURITY] Fedora 34 Update: remmina-1.4.21-1.fc34

Remmina is a remote desktop client written in GTK+, aiming to be useful for system administrators and travelers, who need to work with lots of remote computers in front of either large monitors or tiny net-books. Remmina supports multiple network protocols in an integrated and consistent user...

Sophos Intercept X Advanced code issue vulnerabilities

Sophos Intercept X Advanced is Sophos UK's Intercept X for devices running on Windows and macOS. Intercept X is the industry's most comprehensive endpoint protection, including robust Endpoint Detection and Response EDR and Extended Detection and Response XDR options. A security vulnerability...

GHSA-3HFW-X7GX-437C Path traversal in Matrix Synapse

Impact Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. The last two directories and file name of the path are chosen randomly by Synapse and cannot be...

CVE-2021-41281

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

CVE-2021-24668

The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack...

Cross site request forgery (csrf)

The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack...

CVE-2021-41281

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

Windows 10 chills out, gives sysadmins a break

A few short weeks ago, Microsoft launched the very latest version of its desktop operating system OS, Windows 11. In security terms, Windows 11 is very much Windows 10 with knobs on. Or what Spinal Taps Nigel Tufnel might describe as Windows 10 turned up to 11. Unlike Tufnels description of his...

CVE-2021-43408

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In...

CVE-2021-43408 Duplicate Post WordPress Plugin SQL Injection Vulnerability

The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In...

[SECURITY] Fedora 35 Update: remmina-1.4.21-1.fc35

Remmina is a remote desktop client written in GTK+, aiming to be useful for system administrators and travelers, who need to work with lots of remote computers in front of either large monitors or tiny net-books. Remmina supports multiple network protocols in an integrated and consistent user...

Apple Releases Security Update for iCloud for Windows 13

Apple has released a security update to address multiple vulnerabilities in iCloud for Windows 13. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Apple security page and apply the necessary update. This...

SAP Releases November 2021 Security Updates

SAP has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the SAP Security Notes for November 2021 and apply the...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the necessa...

CVE-2021-24832

The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack...