UBUNTU-CVE-2021-25219

In BIND 9.3.0 - 9.11.35, 9.12.0 - 9.16.21, and versions 9.9.3-S1 - 9.11.35-S1 and 9.16.8-S1 - 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 - 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response...

Securely Advancing in the Sunshine State: Rapid7 Announces Tampa Office Opening

In our quest to create a safer digital world for all, Rapid7 is also on a mission to reimagine the future of work, culture, and talent — admittedly, we've set the bar pretty high for ourselves. But that's part of the spirit of Never Done, one of our core values. We're always striving to do better...

CVE-2021-42044

An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline,...

CVE-2021-42045

CVE-2021-42045 affects MediaWiki’s SecurePoll Growth extension (up to v1.36.2). The issue enables poll alert creation by manipulating the User-Agent header during vote submission. PT Security advisories indicate fixes in newer MediaWiki releases (e.g., 1.36.3+ and 1.37.1+), with broader guidance ...

CVE-2021-42047

An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload such as alert via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback...

CVE-2021-42047

CVE-2021-42047 concerns the Growth extension in MediaWiki up to 1.36.2 with Mentor Dashboard enabled. The issue allows an authenticated mentor to trigger a stored XSS payload (for example via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback) by logging in as a mentor. Multiple co...

CVE-2021-42048

An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits...

CVE-2021-42048

CVE-2021-42048 concerns the Growth extension in MediaWiki up to 1.36.2, where any admin can inject arbitrary JavaScript into the Newcomer home page footer, which is then executed by viewers with zero edits. The issue is triggered by admin-written JS on the footer, enabling code execution in end-u...

Forrester: Embrace Zero Trust for Australia’s Essential Eight

Understand why it's important to refine your organization’s approach. See how to enact a security model that protects your business and enables growth...

CVE-2021-42048: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits...

PT-2021-23484 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.36.2 Description: An issue was discovered in SecurePoll in the Growth extension, where simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote. Recommendations: For...

PT-2021-23486 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.36.2 Description: An issue was discovered in the Growth extension in MediaWiki. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload, such as an...

PT-2021-23487 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.36.2 Description: An issue was discovered in the Growth extension in MediaWiki. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits...

CVE-2021-42045: Improper Neutralization of Input During Web Page Generation

An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote...

CVE-2021-42047: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload such as alert via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback...

Rapid7 Technical Support: Building a Career Path With Endless Possibilities

At Rapid7, our Technical Support teams deliver a world-class support experience to our customers across the globe. We have Support Moose on 4 continents, in 10 offices, and across 8 time zones, but we're all one herd. So, how do we achieve this? We swarm on cases together each day, we collaborate...

Gaming Industry Paves the Way

Currently at $200 billion per year and growing, the gaming industry has grown from humble beginnings in the 1930s during which games like Baffle Ball and pinball were considered a degenerate form of leisure that would lead young men into lives of sin into a massive global phenomenon widely seen a...

Wiz goes (even more) global

The first half of 2021 has been incredible for Wiz. Fueled by an additional $250M in funding $350M total from Sequoia, Index Ventures, Insight, Salesforce, Blackstone, Advent, Greenoaks, and Aglaé Wiz has grown at a blistering pace, going from 25 employees at the start of the year to 120 today...

CVE-2021-23049

On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel TMM memory utilization resulting in an out-of-memory condition and a...

UBUNTU-CVE-2021-40797

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API...