Completed proposals can be voted on and executed again

Handle @cmichelio Vulnerability details Vulnerability Details A proposal that is completed has its state reset, including the votes. Users can just vote on it again and it can be executed again. Impact Completed proposals should most likely not be allowed to be voted on / executed again. This cou...

Logic Flaw Vulnerability in ENLINK CASB Backend Management System

Ltd. specializes in network security product development and sales, is the industry's leading "zero trust" solution provider. A logic flaw exists in the backend management system of ENLINK CASB, which can be exploited by an attacker to cause an arbitrary user password to log into the management...

Logic Flaw Vulnerability in Renzi Gateway Backend Management System

Renzi Network Technology Co., Ltd. was founded in May 2000, and its business covers network security, information security, public security, network resource security, industrial internet security and many other fields, etc. etc. A logic flaw vulnerability exists in the backend management system ...

CVE-2021-21365

Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custo...

TYPO3 代码问题漏洞

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Typo3 Association. A server-side request forgery vulnerability exists in TYPO3 versions prior to 7.2.1, which stems from a failure to check the legitimacy of a request. An attacker can exploit this...

Cross-Site Scripting in extension "2 Clicks for External Media" (media2click)

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...

SQL Injection in extension "Dynamic Content Element" (dce)

The extension fails to properly sanitize user input and is susceptible to SQL Injection. A TYPO3 backend user account is required to exploit the vulnerability...

Weak password vulnerability in the WEB management system of RSR routers of Ruijie Networks Co.(CNVD-2021-34228)

Ruijie Networks is a specialized network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products, storage, and more. A weak password vulnerability exists in the WEB management system of RSR routers of...

Weak Password Vulnerability in TP-LINK Archer-C7 Router

P&T Technologies Ltd. is a leading global provider of network communication equipment. A weak password vulnerability exists in the Archer-C7 router, which can be exploited by an attacker to log into the system backend and perform unauthorized operations...

Weak password vulnerability in TP-LINK TL-WR743ND router

P&T Technologies Ltd. is a leading global provider of network communication equipment. A weak password vulnerability exists in the TL-WR743ND router, which can be exploited by an attacker to log into the system backend and perform unauthorized operations...

Weak password vulnerability in TP-LINK TL-WA801ND router

P&T Technologies Ltd. is a leading global provider of network communication equipment. A weak password vulnerability exists in the TL-WA801ND router, which can be exploited by an attacker to log into the system backend and perform unauthorized operations...

CVE-2021-27400

HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...

CVE-2021-27400

HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...

Weak Password Vulnerability in Telecom Gateway Configuration Management System

Shenzhen Huashimida Information Technology Co., Ltd. is a collection of research and development, production, sales, installation and service in one of the professional interactive video high-tech enterprises. A weak password vulnerability exists in the telecom gateway configuration management...

iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass

Both the iThemes Security free and pro versions were affected. - Patched in Version iThemes Security: 7.9.1 - Patched in Version iThemes Security Pro: 6.8.4 The bug allowed attackers to bypass the "Hide Backend" feature, that, when enabled, hides the WordPress wp-login.php and wp-admin pages...

WordPress iThemes Security plugin <= 7.9.0 - Hide Backend Bypass vulnerability

Hide Backend Bypass vulnerability discovered by Julio Potier SecuPress in WordPress iThemes Security plugin versions = 7.9.0. Solution Update the WordPress iThemes Security plugin to the latest available version at least 7.9.1...

iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass

Both the iThemes Security free and pro versions were affected. - Patched in Version iThemes Security: 7.9.1 - Patched in Version iThemes Security Pro: 6.8.4 The bug allowed attackers to bypass the "Hide Backend" feature, that, when enabled, hides the WordPress wp-login.php and wp-admin pages...

WordPress iThemes Security Pro premium plugin <= 6.8.3 - Hide Backend Bypass vulnerability

Hide Backend Bypass vulnerability discovered by Julio Potier SecuPress in WordPress iThemes Security Pro premium plugin versions = 6.8.3. Solution Update the WordPress iThemes Security Pro premium plugin to the latest available version at least 6.8.4...

H+ backend theme UI framework has file upload vulnerability

H+ Backend Theme UI Framework is a fully responsive, flat theme developed based on the latest version of Bootstrap 3.3.6. A file upload vulnerability exists in the H+ Backend Theme UI Framework, which can be exploited by an attacker to gain control of the server...

dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity chec...