CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - Vulnerabilità di HTML injection nel sistema di prenotazione e prenotazione di eventi online versione 2.3.0. Descrizione tecnica: Esiste una vulnerabilità di HTML injection nel sistema di prenotazione e prenotazione di eventi online versione 2.3.0. Un attaccante può...

EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin ist eine Time-of-Check-Time-of-Use-Schwachstelle im MS-EVEN-Protokoll. Die Schwachstelle ermöglicht es niedrig privilegierten Benutzern, beliebige Dateien auf einem entfernten Rechner zu schreiben, wodurch die Notwendigkeit eines Administratorkontos für eine...

CVE-2021-42662

CVE-2021-42662 CVE-2021-42662 - ऑनलाइन इवेंट बुकिंग और आरक्षण प्रणाली संस्करण 2.3.0 में संग्रहीत क्रॉस-साइट स्क्रिप्टिंग भेद्यता। तकनीकी विवरण: इवेंट प्रबंधन सॉफ्टवेयर संस्करण 2.3.0 में एक संग्रहीत XSS भेद्यता मौजूद है। एक हमलावर इस भेद्यता का उपयोग करके वेब सर्वर के उपयोगकर्ताओं की ओर से...

PT-2026-82281

Name of the Vulnerable Software and Affected Versions ZoneMinder affected versions not specified Description An authenticated OS command injection issue exists in the event export functionality. An authenticated user with View Events permission can execute arbitrary operating system commands on t...

PT-2026-82133

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where perf event open accepts events in the EXIT state as group leaders because early validation only rejects REVOKED and DEAD events. This occurs aft...

EUVD-2026-66111

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Impact djust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated loginrequired / permissionrequired, or an onmount hook that returns a redirect and the connecting user is not authorized, the consumer sent the client a "type":"navigate","to":... redirect frame and then...

CVE-2026-55571

djust , a Phoenix LiveView-style reactive server-side rendering library for Django, is vulnerable to an authentication bypass in versions prior to 1.0.4 . When LiveViewConsumer.handle_mount denies a mount via login_required, permission_required, or a redirecting on_mount hook, it sends a navigate...

CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

santa

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

CVE-2026-74633

A flaw was found in the Linux kernel's tracing module. A local user can trigger a NULL pointer dereference by attempting to remove a specific event filter for an unloaded module. This vulnerability arises when a module-only event filter is cached with a null match, and a subsequent write operatio...

CVE-2026-77144

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-77145

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...

CVE-2026-77129

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...

EUVD-2026-65346

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...

EUVD-2026-65332

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-77144

CVE-2026-77144 is a broken access control vulnerability in the TYPO3 extension Events 2 (events2), specifically in its frontend management plugin. The plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own, while th...

CVE-2026-77144 Broken Access Control in extension "Events 2" (events2)

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

EUVD-2026-65331

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...