CVE-2021-30671

A validation issue was addressed with improved logic. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina. A malicious application may be able to send unauthorized Apple events to Finder...

CVE-2021-30671

CVE-2021-30671 describes a validation issue in macOS that allowed a malicious application to send unauthorized Apple events to Finder. The issue is addressed by improved logic and is fixed in macOS Big Sur 11.4 and Security Update 2021-003 Catalina (MACOS HT212529/HT212530). In affected systems r...

Moderate: Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8]

An update for cockpit-ovirt, ovirt-host, ovirt-hosted-engine-ha, ovirt-hosted-engine-setup, and vdsm is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...

nTokenERC20Proxy emits events even when not success

Handle cmichel Vulnerability details Vulnerability Details The nTokenERC20Proxy functions emit events all the time, even if the return value from the inner call returns false indicating an unsuccessful action. Impact An off-chain script scanning for Transfer or Approval events can be tricked into...

Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Go to the plugin Settings Messages Taxonomies...

WordPress Modern Events Calendar Lite plugin <= 5.22.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Shivam Rai in WordPress Modern Events Calendar Lite plugin versions = 5.22.1. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.22.2...

Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Go to the plugin Settings Messages Taxonomies...

CVE-2021-35223 Execute Command Function Allows Remote Code Execution (RCE)Vulnerability

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution...

WordPress Modern Events Calendar remote code execution vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up websites on servers supporting PHP and MySQL databases, and can also be used as a content management system CMS. WordPress Modern Events Calendar has a remote code execution vulnerability that can be exploited...

Python -- multiple vulnerabilities

Python reports: bpo-42278: Replaced usage of tempfile.mktemp with TemporaryDirectory to avoid a potential race condition. bpo-41180: Add auditing events to the marshal module, and stop raising code.init events for every unmarshalled code object. Directly instantiated code objects will continue to...

CVE-2021-28694

creationtimestamp| type| source ---|---|--- 2021-08-27 22:28:24+00:00| seen| https://t.me/cibsecurity/27958 2021-08-27 22:28:31+00:00| seen| https://t.me/cibsecurity/27963 2021-08-27 22:28:37+00:00| seen| https://t.me/cibsecurity/27967...

CVE-2021-28696

creationtimestamp| type| source ---|---|--- 2021-08-27 22:28:24+00:00| seen| https://t.me/cibsecurity/27958 2021-08-27 22:28:31+00:00| seen| https://t.me/cibsecurity/27963 2021-08-27 22:28:37+00:00| seen| https://t.me/cibsecurity/27967...

CVE-2021-29441

creationtimestamp| type| source ---|---|--- 2021-08-25 13:22:18+00:00| seen| https://t.me/truesecator/2035 2021-10-28 16:23:30+00:00| published-proof-of-concept| https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/nacoscve202129441 2023-12-08 13:07:04+00:00|...

CVE-2021-32779

creationtimestamp| type| source ---|---|--- 2021-08-25 00:23:30+00:00| seen| https://t.me/cibsecurity/27848 2021-09-10 02:29:59+00:00| seen| https://t.me/cibsecurity/28639...

CVE-2021-32777

creationtimestamp| type| source ---|---|--- 2021-08-25 00:23:28+00:00| seen| https://t.me/cibsecurity/27847 2021-09-10 02:29:59+00:00| seen| https://t.me/cibsecurity/28639...

CVE-2021-39144

creationtimestamp| type| source ---|---|--- 2021-08-23 22:23:29+00:00| seen| https://t.me/cibsecurity/27713 2021-08-24 06:17:39+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/379 2022-10-26 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=903 2022-10-26...

CVE-2021-24552

The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the eventid POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue...

CVE-2021-24553

The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin...

CVE-2021-24553

The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin...

CVE-2021-24552

The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the eventid POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue...