Adobe Critical Code-Execution Flaws Plague Windows Users

Adobe has issued patches for a slew of critical security vulnerabilities, which, if exploited, could allow for arbitrary code execution on vulnerable Windows systems. Affected products include Adobe’s Framemaker document processor, designed for writing and editing large or complex documents;...

Command Execution Vulnerability in Journal Manuscript Acquisition and Editing System of Beijing Magtech Technology Development Co.

Journal Manuscript Acquisition and Editing System is a new 3-generation journal manuscript remote processing platform developed by Beijing Magtech. A command execution vulnerability exists in the Journal Manuscript Acquisition and Editing System of Beijing Magtech Technology Development Co., Ltd...

Process Steps Template Designer < 1.3 - CSRF to Stored Cross-Site Scripting (XSS)

The plugin did not properly check its CSRF nonce in the FontAwesomeField.save method, which could allow attackers to make logged in users capable of editing posts change the Step Icon of arbitrary Process Steps. Due to the lack of sanitisation of the submitted Step icon value, it could also lead ...

GHSA-P7V4-GM6J-CW9M XSS in Mautic

Impact This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed. This vulnerability was reported by Dardan Prebreza at Bishop Fox. Patches Upgrade to 3.2.4 or 2.16.5. Link to patch for 2.x...

CVE-2021-22849

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

Cross site scripting

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

CVE-2021-22849 Hyweb HyCMS-J1 - Stored XSS

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

CVE-2021-22849

CVE-2021-22849 affects Hyweb HyCMS-J1; the backend editing function does not filter special characters, enabling stored XSS where logged-in users can inject JavaScript. Root cause: insufficient input sanitization on editing payloads. Documented impact includes stored XSS risk with potential parti...

PT-2021-15222

Name of the Vulnerable Software and Affected Versions Hyweb HyCMS-J1 affected versions not specified Description The backend editing function of Hyweb HyCMS-J1 does not filter special characters, allowing users who are logged in to inject JavaScript syntax and perform a stored XSS Stored Cross-si...

Hyweb HyCMS-J Cross-Site Scripting Vulnerability

Hyweb HyCMS-J1 is a text management system from the Chinese company Hyweb. Hyweb HyCMS-J1 suffers from a cross-site scripting vulnerability that stems from the back-end editing function not filtering special characters. An attacker can exploit this vulnerability to inject JavaScript syntax to...

CVE-2021-22849: Improper Neutralization of Input During Web Page Generation

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

The vulnerability in the input method editor (IME) editing methods of Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the input method editor IME editing tools in Firefox, Firefox ESR, and the email client Thunderbird is related to the use of memory after event handling is released. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Adobe Fixes 7 Critical Flaws, Blocks Flash Player Content

Adobe Systems has patched seven critical vulnerabilities, which impact Windows, macOS and Linux users. The impact of the serious flaws range from arbitrary code execution to sensitive information disclosure. The software company’s regularly scheduled Tuesday security updates impact a slew of its...

EV Clips Win suffers from dll hijacking vulnerability

EV Clips is a video editing software. EV Clips Win suffers from a dll hijacking vulnerability. An attacker can exploit the vulnerability to load a malicious dll and execute malicious code...

January 5, 2021, update for Project 2016 (KB4493159)

None None...

Code injection

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...

The new Wondershare PDFelement with added features

By Sudais Asif PDFelement is an all-in-one PDF solution allowing users to edit, convert, and optimise documents securely. Here's how it works. This is a post from HackRead.com Read the original post: The new Wondershare PDFelement with added features...

CVE-2020-29254

TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the...

Tiki Wiki Cross-Site Request Forgery Vulnerability

Tiki Wiki is a Php-based wiki system for the Tiki community. A security vulnerability exists in Tiki Wiki 21.2 that allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to exploit the vulnerability to perform a cross-site request forgery CSRF...

CVE-2020-29254: Cross-Site Request Forgery (CSRF)

TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the...