CVE-2021-24734

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2021-24735

The CVE-2021-24735 entry concerns the WordPress plugin Compact WP Audio Player (pre-1.9.7). Connected sources corroborate a CSRF vulnerability caused by missing nonce checks, enabling an attacker with a logged‑in admin session to change the Disable Simultaneous Play setting. Affected version rang...

CVE-2021-24734

The CVE-2021-24734 entry affects the WordPress Compact WP Audio Player plugin (versions prior to 1.9.7). The root cause is insufficient escaping of shortcodes attributes, enabling Stored XSS by users with as low as Contributor. Impact is client-side JavaScript execution in affected pages. Remedia...

CVE-2021-24734 Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

PT-2021-16235

Name of the Vulnerable Software and Affected Versions: Compact WP Audio Player WordPress plugin versions prior to 1.9.7 Description: The issue allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks due to the plugin not escaping some of its shortcode...

CVE-2021-24735: Cross-Site Request Forgery (CSRF)

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack...

PT-2021-16236

Name of the Vulnerable Software and Affected Versions: Compact WP Audio Player versions prior to 1.9.7 Description: The issue concerns the lack of nonce checks in the Compact WP Audio Player WordPress plugin, which could allow attackers to make a logged-in admin change the Disable Simultaneous Pl...

CVE-2021-24734: Improper Neutralization of Input During Web Page Generation

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

WordPress Compact WP Audio Player plugin <= 1.9.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Compact WP Audio Player plugin versions = 1.9.6. Solution Update the WordPress Compact WP Audio Player plugin to the latest available version at least 1.9.7...

WordPress Compact WP Audio Player plugin <= 1.9.6 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by apple502j in WordPress Compact WP Audio Player plugin versions = 1.9.6. Solution Update the WordPress Compact WP Audio Player plugin to the latest available version at least 1.9.7...

Siemens Desigo CC Series CCOM Communication Component Deserialization Vulnerability

Cerberus DMS is a hazard management station that helps users manage fire safety and security incidents.Desigo CC is an integrated building management platform for managing high-performance buildings.Desigo CC Compact expands the portfolio with solutions tailored for small and medium-sized...

CVE-2021-37181

A vulnerability has been identified in Cerberus DMS V4.0 All versions, Cerberus DMS V4.1 All versions, Cerberus DMS V4.2 All versions, Cerberus DMS V5.0 All versions v5.0 QU1, Desigo CC Compact V4.0 All versions, Desigo CC Compact V4.1 All versions, Desigo CC Compact V4.2 All versions, Desigo CC...

CVE-2021-27391

A vulnerability has been identified in APOGEE MBC PPC P2 Ethernet All versions = V2.6.3, APOGEE MEC PPC P2 Ethernet All versions = V2.6.3, APOGEE PXC Compact BACnet All versions = V2.8, APOGEE PXC Modular BACnet All versions = V2.8, TALON TC Compact BACnet All versions V3.5.3, TALON TC Modular...

Deserialization of untrusted data

A vulnerability has been identified in Cerberus DMS V4.0 All versions, Cerberus DMS V4.1 All versions, Cerberus DMS V4.2 All versions, Cerberus DMS V5.0 All versions v5.0 QU1, Desigo CC Compact V4.0 All versions, Desigo CC Compact V4.1 All versions, Desigo CC Compact V4.2 All versions, Desigo CC...

CVE-2021-37181

A vulnerability has been identified in Cerberus DMS V4.0 All versions, Cerberus DMS V4.1 All versions, Cerberus DMS V4.2 All versions, Cerberus DMS V5.0 All versions v5.0 QU1, Desigo CC Compact V4.0 All versions, Desigo CC Compact V4.1 All versions, Desigo CC Compact V4.2 All versions, Desigo CC...

CVE-2021-27391

Summary: CVE-2021-27391 affects Siemens APOGEE and TALON devices. The vulnerability is a buffer overflow in the web server caused by improper bounds checking when parsing the Host header in HTTP requests. The issue affects multiple products/versions: APOGEE MBC (PPC) and APOGEE MEC (PPC) with ver...

CVE-2021-27391: Buffer Copy without Checking Size of Input

A vulnerability has been identified in APOGEE MBC PPC P2 Ethernet All versions = V2.6.3, APOGEE MEC PPC P2 Ethernet All versions = V2.6.3, APOGEE PXC Compact BACnet All versions = V2.8, APOGEE PXC Modular BACnet All versions = V2.8, TALON TC Compact BACnet All versions V3.5.3, TALON TC Modular...

Vulnerabilities in product codes of various Siemens products

Cerberus DMS is a hazard management station that helps users manage fire safety and security incidents.Desigo CC is an integrated building management platform for managing high-performance buildings.Desigo CC Compact expands the portfolio with solutions tailored for small and medium-sized...

CVE-2021-37181: Deserialization of Untrusted Data

A vulnerability has been identified in Cerberus DMS V4.0 All versions, Cerberus DMS V4.1 All versions, Cerberus DMS V4.2 All versions, Cerberus DMS V5.0 All versions v5.0 QU1, Desigo CC Compact V4.0 All versions, Desigo CC Compact V4.1 All versions, Desigo CC Compact V4.2 All versions, Desigo CC...

PT-2021-4188

Name of the Vulnerable Software and Affected Versions APOGEE MBC PPC P2 Ethernet versions V2.6.3 and later APOGEE MEC PPC P2 Ethernet versions V2.6.3 and later APOGEE PXC Compact BACnet versions prior to V3.5.3 APOGEE PXC Compact P2 Ethernet versions V2.8 and later APOGEE PXC Modular BACnet...