5469 matches found
Event Calendar < 1.1.51 - Subscriber+ Event Creation
The plugin does not have proper authorisation and CSRF checks in the addcalendarevent AJAX actions, allowing users with a role as low as subscriber to create events Adding calendar events: fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...
DEBIAN-CVE-2021-41496
Buffer overflow in the arrayfrompyobj function of fortranobject.c in NumPy 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be...
PYSEC-2021-857
Buffer overflow in the arrayfrompyobj function of fortranobject.c in NumPy 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values...
UBUNTU-CVE-2021-41496
Buffer overflow in the arrayfrompyobj function of fortranobject.c in NumPy 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be...
PT-2021-8282
Name of the Vulnerable Software and Affected Versions NumPy versions prior to 1.19 Description The issue is related to a buffer overflow in the array from pyobj function of fortranobject.c in NumPy, which can be exploited to conduct Denial of Service attacks by carefully constructing an array wit...
PT-2021-15549
Name of the Vulnerable Software and Affected Versions ajaxpro.2 versions prior to 21.11.29.1 Description This issue involves the deserialization of untrusted data, which occurs when an application deserializes data without sufficient verification, allowing an attacker to control the execution flo...
_calculateMaltRequiredForExit makes wrong calculations
Handle 0x0x0x Vulnerability details Proof of concept calculateMaltRequiredForExit calculates the quantity of malts returned. uint256 maltQuantity = userMaltPurchased.mulamount.divuserCommitment; uint256 fullReturn = maltQuantity.mulcurrentPrice / pegPrice; userMaltPurchased / userCommitment...
secure.action.news Cross Site Scripting vulnerability OBB-2282566
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF that allows user account takeover. Note: All applications using any version of the frontend component of spreeauthdevise are affected if protectfromforgery method is both: Executed whether as: A...
Cross-site Request Forgery (CSRF)
Overview solidusauthdevise is a Provides authentication and authorization services for use with Solidus by using Devise and CanCan. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via solidusauthdevise. Note: Users are affected only if protectfromforgery method...
CVE-2021-41275
spreeauthdevise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spreeauthdevise is subject to a CSRF vulnerability that allows user account...
CVE-2021-24847
The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is...
PT-2021-23235 · Unknown · Spree Auth Devise
Name of the Vulnerable Software and Affected Versions: spree auth devise versions prior to 4.0.1 spree auth devise versions prior to 4.1.1 spree auth devise versions prior to 4.2.1 spree auth devise versions prior to 4.4.1 Description: The issue is a CSRF vulnerability that allows user account...
VaderPoolV2 minting synths & fungibles can be frontrun
Handle cmichel Vulnerability details The VaderPoolV2 mintFungible and mintSynth functions perform an unsafe nativeAsset.safeTransferFromfrom, addressthis, nativeDeposit with a parameter-specified from address. Note that these functions are not called by the Router, they are directly called on the...
CVE-2021-43611
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header...
CVE-2021-43611
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header...
CVE-2021-43611
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header...
CVE-2021-43610
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header request URI without a parameter in an unauthenticated SIP message, a different issue than CVE-2021-33056...
