14523 matches found
PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability (CNVD-2021-76088)
PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS that stems from the failure of the website field of the product's podcast comment feature to properly...
Security feature bypass
Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator DRA product, affecting all DRA versions prior to 10.1 Patch 1. The vulnerability could lead to unauthorized information disclosure...
CVE-2021-41096
Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm RSA/ECB/PKCS1Padding. The issue will be patched in v2.3 for release builds and 426 onwards for...
CVE-2021-41096
Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm RSA/ECB/PKCS1Padding. The issue will be patched in v2.3 for release builds and 426 onwards for...
Security feature bypass
An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass...
PortlandLabs Concrete Cms 跨站脚本漏洞
PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS that stems from the failure of the website field of the product's podcast comment feature to properly...
$8,000 Bug Bounty Highlight: XSS to RCE in the Opera Browser
Research $8,000 Bug Bounty Highlight: XSS to RCE in the Opera Browser Share September 24th, 2021 Continuing from hisprevious post, Bug Bounty Hunter Renwa writes about the second vulnerability he submitted to Opera’s Private Bug Bounty Programme: a Remote Code Execution in Opera’s My Flow Feature...
Openvpn OpenVPN 授权问题漏洞
Openvpn OpenVPN is a software package from the American company OpenVPN Openvpn for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using a public key, an e-certificat...
Oracle Linux 8 : curl (ELSA-2021-3582)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3582 advisory. - fix bad connection reuse due to flawed path name checks CVE-2021-22924 Tenable has extracted the preceding description block directly from the Oracle...
PT-2021-4500 · Cisco · Cisco Ios Xe
Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the H.323 application level gateway ALG used by the Network Address Translation NAT feature could allow an unauthenticated, remote attacker to bypass the AL...
Mcafee McAfee Agent 安全漏洞
Mcafee McAfee Agent MA is a McAfee client component that provides secure communication between ePolicy Orchestrator antivirus management platform and managed products. A security vulnerability exists in the maconfig feature of McAfee Agent for Windows prior to version 5.7.4, which stems from the...
CVE-2021-24400
The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-24403
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors...
CVE-2021-1939
Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...
CVE-2021-1939
Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...
Amazon Linux 2 : curl, --advisory ALAS2-2021-1700 (ALAS-2021-1700)
The version of curl installed on the remote host is prior to 7.76.1-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1700 advisory. A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature...
CVE-2016-20012
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE...
UBUNTU-CVE-2021-39210
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie when a user uses the "remember me" feature is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue ...