Arbitrary File Deletion Vulnerability in Joomla!

SP Page Builder plugin is a free page builder component that users can use on joomla sites to design and edit site page content. An arbitrary file deletion vulnerability exists in Joomla! SP Page Builder, which can be exploited to delete arbitrary files on the target server...

CVE-2020-26680

In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to...

WordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress Membership & Learning Management System Plugin for WordPress plugin prior to version 4.21.1, which stems from the plugin generating...

Denial of Service Vulnerability in OP20 Series Screen Setup Tool

OP20 is a screen editing software developed by Wuxi Xinjie Electric Co. A denial-of-service vulnerability exists in the OP20 Series Screen Setting Tool, which can be exploited by attackers to cause a denial of service...

Vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are caused by privilege management errors, allowing attackers to write arbitrary files to the device’s file system.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are due to privilege management errors. Exploiting these vulnerabilities can allow an attacker to remotely write arbitrary files...

Pluck Cross-Site Request Forgery Vulnerability

Pluck is a small and simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.10-dev2. An attacker can exploit this vulnerability to edit a page via /admin.php?action=editpage...

PT-2021-19812 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 11.10.13 XWiki Platform versions prior to 12.6.7 XWiki Platform versions prior to 12.10.2 Description: A user disabled on a wiki using email verification for registration can re-activate themselves by using th...

JetBrains Code With Me Code Execution Vulnerability

JetBrains Code With Me is a plug-in application from the Czech company JetBrains that provides code co-editing for the IntelliJ IDE. A code execution vulnerability exists in JetBrains Code With Me versions prior to 2021.1. An attacker can exploit the vulnerability to execute code in read-only mod...

Unspecified Vulnerability in JetBrains Code With Me

JetBrains Code With Me is a plug-in application from the Czech company JetBrains that provides code co-editing for the IntelliJ IDE. A security vulnerability exists in JetBrains Code With Me versions prior to 2021.1. An attacker can exploit the vulnerability to open a browser on the host computer...

Gutenberg - Critical - Access bypass - SA-CONTRIB-2021-007

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not correctly validate access rules in certain situations allowing anonymous users to delete blocks...

Adobe Acrobat/Reader post-release reuse vulnerability (CNVD-2021-49202)

Adobe Acrobat is a PDF editing software developed by Adobe.Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. Adobe Acrobat/Reader has a post-release reuse vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Denial of service

CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular...

CVE-2021-21391

Removed by vendor...

Editing Text in a PDF File

By Uzair Amir PDF Portable Document Format is a file format developed by Adobe Systems that provides an electronic display of information such as documents, presentations, etc. This is a post from HackRead.com Read the original post: Editing Text in a PDF File...

Any logged in user could edit any other logged in user.

Impact Everyone who is running a12n-server. A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patches Patched in v0.18.2...

Insecure Access Controls

@curveball/a12n-server uses insecure access controls. Inadequate permissiosn check allows any authenticated user to perform unauthorized editting of other users' information...

CVE-2021-29452

CVE-2021-29452 : A flawed privilege check in the a12n-server HAL-Form for editing users (v0.18.0) allowed any logged-in user to edit other users. Patched in v0.18.2. Multiple connected advisories corroborate insecure access controls affecting all users of the package; remediation is upgrade to th...

CVE-2021-29452 Any logged in user could edit any other logged in user.

a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make th...

CVE-2021-26076

The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn...

Cross site scripting

Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting XSS vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious UR...