WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability in the WordPress plugin WP Fusion Lite allows attackers to inject arbitrary...

PT-2021-20630

Name of the Vulnerable Software and Affected Versions: WP Fusion Lite versions up to and including 3.37.18 Description: The issue allows attackers to perform Cross-Site Request Forgery via the show logs section function found in the /includes/admin/logging/class-log-handler.php file, which enable...

CVE-2021-34661: Cross-Site Request Forgery (CSRF)

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the showlogssection function found in the /includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18...

CVE-2021-34660: Improper Neutralization of Input During Web Page Generation

The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the /includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18...

PT-2021-20629

Name of the Vulnerable Software and Affected Versions: WP Fusion Lite versions up to and including 3.37.18 Description: The issue allows attackers to inject arbitrary web scripts via the startdate parameter in the /includes/admin/logging/class-log-table-list.php file, enabling Reflected Cross-Sit...

Huawei EulerOS: Security Advisory for python-cryptography (EulerOS-SA-2021-2278)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : python-cryptography (EulerOS-SA-2021-2252)

According to the version of the python-cryptography package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could...

Zoom Settlement: An $85M Business Case for Security Investment

Ransomware isn’t the only way lax security can cost a business eight figures in damage. Zoom just lost an $85 million class-action lawsuit this week for its cybersecurity missteps, proving that even the most essential and relied-upon brands can be tripped up by inadequate security. More...

The vulnerability of the implementation of the Logging::update_logging() method in the CMS system of Concrete5 allows a perpetrator to execute arbitrary PHP code.

The vulnerability of the Logging::updatelogging method implementation in the Concrete5 CMS system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary PHP code...

CVE-2021-24503

The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still hav...

PT-2021-28364

Name of the Vulnerable Software and Affected Versions: AccessControl versions 4.0 through 4.2 AccessControl versions 5.0 through 5.1 Description: The issue concerns the AccessControl module in Zope applications, which defines security policies for Python code. It allows restricted access to Pytho...

PT-2021-17400

Name of the Vulnerable Software and Affected Versions SourceCodester CASAP Automated Enrollment System version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the class name parameter to "update class.php" API endpoint. This enables attackers to perfor...

CASAP Automated Enrollment 跨站脚本漏洞

CASAP Automated Enrollment is an automated enrollment system from the CASAP organization. The goal of the project is to provide CASAP with an automated enrollment system to streamline the school process and make it more effective, efficient and easily retrievable. SourceCodester CASAP Automated...

Combodo iTop 安全漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. Combodo iTop version 2.7.4 prior to a security vulnerabilit...

Mimosa B5 操作系统命令注入漏洞

Mimosa B5 is mimosa's network device Mimosa B5 backhaul is the easiest to deploy and highest capacity unlicensed 5 GHz backhaul solution for short to medium range link applications. A security vulnerability exists in Mimosa B5, B5c that allows injection via authenticated commands in the Throughpu...

Rancher Labs Rancher has an unspecified vulnerability

Rancher Labs Rancher is an open source, enterprise-class container management platform from Rancher Labs, Inc. A security vulnerability exists in Rancher Labs Rancher, which stems from a reliance on untrusted input in a security decision vulnerability in Rancher. An attacker could exploit the...

The vulnerability of the __cil_verify_classperms() function in the SELinux access control system allows a perpetrator to trigger a service failure.

The vulnerability of the cilverifyclassperms function in the SELinux access control system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to trigger a service failure...

The vulnerability of the cil_reset_classpermission() function in the SELinux access control system allows a perpetrator to trigger a service failure.

The vulnerability of the cilresetclasspermission function in the SELinux access control system is related to the use of memory after it is freed. Exploiting this vulnerability could allow a attacker to cause a service failure...

Huawei AR1220F-S has a weak password vulnerability

Huawei AR1220F-S is a new-generation enterprise-class gigabit router. The Huawei AR1220F-S has a weak password vulnerability, which can be exploited by attackers to log into the system backend and obtain sensitive information...

VMware vCenter Server Virtual SAN Health Check Remote Code Execution Exploit

This Metasploit module exploits Java unsafe reflection and SSRF in the VMware vCenter Server Virtual SAN Health Check plugin's ProxygenController class to execute code as the vsphere-ui user. See the vendor advisory for affected and patched versions. Tested against VMware vCenter Server 6.7 Updat...