Google Chrome Resource Management Error Vulnerability (CNVD-2021-31239)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a resource management error vulnerability that could allow a remote attacker to create a specially crafted web page, trick a victim into visiting the page, trigger a release and then use the error and...

Innorix Web-Based File Transfer 参数注入漏洞

INNORIX Innorix Web-Based File Transfer is an application system from INNORIX Korea. It is used for file transfer. Web-Based File Transfer Solution 9.2.18.385 suffers from a parameter injection vulnerability that can be exploited by a remote attacker to potentially trick a user into visiting a...

SUSE: Security Advisory (SUSE-SU-2018:1509-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2021-23998

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

SUSE: Security Advisory (SUSE-SU-2018:1536-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mail.ru: Subdomain takeover on "info-edcrunch.skillfactory.ru"

Domain, site, application -- http://info-edcrunch.skillfactory.ru/ Here there is a skillfactory domain info-edcrunch.skillfactory.ru which is pointing towards tilda pages so this domain can be taken over can can be used to do any type of attacks mostly i can make a fake login page on your behalf...

Unspecified Vulnerability in Google Chrome (CNVD-2021-34543)

Chrome is a web browsing tool developed by Google. A security vulnerability exists in Google Chrome versions prior to 90.0.4430.72. A remote attacker can leak cross-origin data through a carefully crafted HTML page...

CVE-2021-29450

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases...

CVE-2021-29450

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases...

CVE-2021-29450 WordPress Authenticated disclosure of password-protected posts and pages

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases...

WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure

Description The Latest Posts block in the WordPress editor can be exploited in a way that exposes password-protected posts and pages via the posts REST API when the "edit" context was used. This requires at least contributor privileges. PoC 1. As one user, create a new password protected post...

WordPress 信息泄露漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. An information disclosure vulnerability exists in Wordpress CMS that originates from being used ...

Vulnerabilities fixed in Juniper Junos OS

Juniper has fixed vulnerabilities in Junos OS. The vulnerabilities allow a remote malicious person to to bypass a security measure and to cause a denial-of-service cause Juniper has released updates to fix the vulnerabilities. More information can be found on the pages below:...

Joomla! 3.x < 3.9.26 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.9.26. It is, therefore, affected by multiple vulnerabilities. - Inadequate escaping allowed Cross-Site Scripting XSS using the logo parameter of the default templates on error pages...

WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure

Description The Latest Posts block in the WordPress editor can be exploited in a way that exposes password-protected posts and pages via the posts REST API when the "edit" context was used. This requires at least contributor privileges. 1. As one user, create a new password protected post. Ensure...

CVE-2021-26030

An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page...

CVE-2021-26030 [20210401] - Core - Escape xss in logo parameter error pages

An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page...

Authentication flaw

Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed with layouts, menus and functionalities...

CVE-2021-29440

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the...

CVE-2021-24226

In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the accessallyorderform shortcode is dumping serialize$SERVER, which contains all environment variables. The leakage occurs on all public facing pages containing the...