CVE-2021-20124

creationtimestamp| type| source ---|---|--- 2021-10-13 20:26:47+00:00| seen| https://t.me/cibsecurity/30518 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-20124.yaml 2024-09-03 18:10:03+00:00| seen|...

Pterodactyl 授权问题漏洞

Pterodactyl is an open source game server administration panel built using PHP, Nodejs and Go. Pterodactyl suffers from a security vulnerability that allows a malicious user to modify the content of the confirmationtoken input during the two-factor authentication process to refer to cached values...

Use of a Broken or Risky Cryptographic Algorithm in anonaddy/anonaddy

Description MD5 and SHA-1 are popular cryptographic hash algorithms often used to verify the integrity of messages and other data. Recent advances in cryptanalysis have discovered weaknesses in both algorithms. Consequently, MD5 and SHA-1 should no longer be relied upon to verify the authenticity...

PT-2021-23112 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl affected versions not specified Description: A malicious user can modify the contents of a confirmation token input during the two-factor authentication process to reference a cache value not associated with the login attempt. Thi...

spakompagniet.dk Cross Site Scripting vulnerability OBB-2150202

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Cross-site Scripting (XSS) - Stored in yogeshojha/rengine

✍️ Description 'Delete Scheduled Task' confirmation model executes javascript as part of the name of a scan engine. 🕵️‍♂️ Proof of Concept 1. Name a scan engine as a XSS payload. Example: 2. Schedule a scan for any target using the created scan engine. 3. Try to delete the scheduled task Location...

CVE-2021-39165

creationtimestamp| type| source ---|---|--- 2021-08-27 00:27:08+00:00| seen| https://t.me/cibsecurity/27932 2021-08-31 13:10:52+00:00| seen| https://t.me/CyberSecurityTechnologies/4194 2022-03-18 06:41:26+00:00| published-proof-of-concept| https://t.me/cKure/9068 2023-05-26 10:28:54+00:00|...

CVE-2021-36792

The datednews aka Dated News extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications...

CVE-2021-36792

The CVE-2021-36792 issue affects the TYPO3 dated_news extension (versions up to 5.1.1). Root cause: incorrect Access Control for confirming various applications. Impact (as described in related sources): attackers could confirm various applications and potentially access all application registrat...

CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

Design/Logic Flaw

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-37543

In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects...

CVE-2021-37543

CVE-2021-37543 affects JetBrains RubyMine prior to 2021.1.1. The vulnerability permits code execution without user confirmation for untrusted projects. The issue is documented in CVE-2021-37543 and is listed in JetBrains’ Security Bulletin Q2-2021, which shows RubyMine was resolved in version 202...

Admin and treasury change should be confirmed.

Handle tensors Vulnerability details Impact Inputting the wrong address here could lock out a lot of the funds and smart contract methods. Proof of Concept Recommended Mitigation Steps Require the changed address to confirm the switch with a pendingAdmin, pendingTreasury variable. --- The text wa...

CVE-2021-20090

creationtimestamp| type| source ---|---|--- 2021-08-04 11:27:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/3986 2021-08-08 08:22:21+00:00| exploited| https://t.me/cKure/6532 2021-08-08 14:28:35+00:00| exploited| https://t.me/CyberSecurityTechnologies/4021 2021-08-08...

CVE-2021-37216

creationtimestamp| type| source ---|---|--- 2021-08-02 16:27:25+00:00| seen| https://t.me/cibsecurity/26674 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-37216.yaml...

New CISA Director Confirmed, W.H. Gains Cyber-Director

The U.S. has made a key move to shore up its cybersecurity strategy, with the confirmation of Jen Easterly as the director of the Cybersecurity and Infrastructure Security Agency CISA on Monday. Easterly, a former official at the National Security Agency from 2011 to 2013 and two-time Bronze Star...