CVE-2021-0662

creationtimestamp| type| source ---|---|--- 2021-10-25 18:23:26+00:00| seen| https://t.me/cibsecurity/31140 2021-11-25 10:36:56+00:00| seen| https://t.me/BlueRedTeam/1224 2021-11-25 11:00:21+00:00| seen| https://t.me/CyberSecurityTechnologies/4828 2021-11-25 15:06:57+00:00| seen|...

USN-5115-1: Linux kernel (OEM) vulnerabilities

It was discovered that a race condition existed in the Atheros Ath9k WiFi driver in the Linux kernel. An attacker could possibly use this to expose sensitive information WiFi network traffic. CVE-2020-3702 Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF...

Design/Logic Flaw

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Workflow Events. Supported versions that are affected are 12.2.6-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping...

CVE-2021-35563

CVE-2021-35563 affects Oracle Shipping Execution in Oracle E-Business Suite (component: Workflow Events). Affected versions: 12.2.6–12.2.10. The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise data, enabling unauthorized creation, deletion, or modificati...

CVE-2021-41556

creationtimestamp| type| source ---|---|--- 2021-10-19 17:14:06+00:00| seen| https://t.me/thehackernews/1594 2022-07-29 00:12:46+00:00| seen| https://t.me/cibsecurity/47244...

October 12, 2021—KB5006739 (Monthly Rollup)

None None...

October 12, 2021—KB5006714 (Monthly Rollup)

None None...

WordPress Easy PayPal Events plugin <= 1.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Easy PayPal Events plugin versions = 1.1.1. Solution Update the WordPress Easy PayPal Events plugin to the latest available version at least 1.1.2...

CVE-2021-41861

creationtimestamp| type| source ---|---|--- 2021-10-10 11:31:18+00:00| seen| https://t.me/thebugbountyhunter/5706 2021-11-09 03:33:52+00:00| seen| https://t.me/androidMalware/1330...

WordPress插件Modern Events Calendar Lite跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.The WordPress plugin Modern Events Calendar Lite has a cross-site scripting vulnerability that stems fro...

CVE-2021-25484

Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event...

Threat hunting in large datasets by clustering security events

By Tiago Pereira. Security tools can produce very large amounts of data that even the most sophisticated organizations may struggle to manage. Big data processing tools, such as spark, can be a powerful tool in the arsenal of security teams.This post walks through threat hunting on large...

Missing events/timelocks for owner/admin only functions that change critical parameters

Handle defsec Vulnerability details Impact Owner/admin only functions that change critical parameters should emit events and have timelocks. Events allow capturing the changed parameters so that off-chain tools/interfaces can register such changes with timelocks that allow users to evaluate them...

CVE-2021-24687

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24687

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24687

CVE-2021-24687 affects the WordPress plugin Modern Events Calendar Lite up to version 5.22.2. Multiple sources indicate a failure to escape certain settings before output in attributes, enabling Cross-Site Scripting (XSS) by high-privilege users, even when unfiltered_html is disallowed. The vulne...

Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Add/Edit a Custom Field /wp-admin/admin.php?page=eme-formfields and put the following payload in the Field Name:...

WordPress Events Made Easy plugin <= 2.2.23 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Huy Nguyen in WordPress Events Made Easy plugin versions = 2.2.23. Solution Update the WordPress Events Made Easy plugin to the latest available version or at least to the version 2.2.24...

Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Add/Edit a Custom Field /wp-admin/admin.php?page=eme-formfields and put the following payload in the Field...