Oracle Primavera P6 Enterprise Project Portfolio Management has an unspecified vulnerability

Primavera P6 Enterprise Project Portfolio Management is a comprehensive project portfolio management PPM solution with role-specific functionality to meet the needs, responsibilities, and skills of each team member.Primavera P6 Enterprise Project Portfolio Management versions 17.12.0-17.12.20,...

Oracle Primavera P6 Enterprise Project Portfolio Management (Jul 2021 CPU)

The 17.12, 18.8, 19.12, and 20.12 versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product...

PT-2021-7191

Name of the Vulnerable Software and Affected Versions Primavera P6 Enterprise Project Portfolio Management versions 20.12.0 through 20.12.3 Description The issue is related to insufficient input validation in the Web Access component of the Primavera P6 Enterprise Project Portfolio Management...

PT-2021-7138

Name of the Vulnerable Software and Affected Versions Primavera P6 Enterprise Project Portfolio Management versions 17.12.0 through 17.12.20 Primavera P6 Enterprise Project Portfolio Management versions 18.8.0 through 18.8.23 Primavera P6 Enterprise Project Portfolio Management versions 19.12.0...

CVE-2021-2366: Undefined Security Weakness

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 17.12.0-17.12.20, 18.8.0-18.8.23, 19.12.0-19.12.14 and 20.12.0-20.12.3. Easily exploitable vulnerability allows...

CVE-2021-2386: Undefined Security Weakness

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 20.12.0-20.12.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

MISA expands portfolio and looks ahead during Microsoft Inspire

This blog post is part of the Microsoft Intelligent Security Association MISA guest blog series. Learn more about MISA. Welcome to fiscal year 2022 FY22 and my first official blog as the MISA Lead. It’s been a whirlwind couple of months getting up to speed with all things MISA—closing out FY21...

Microsoft to acquire RiskIQ to strengthen cybersecurity of digital transformation and hybrid work

Organizations are increasingly using the cloud to reimagine every facet of their business. Hybrid work has accelerated this digital transformation, and customers are challenged with the increasing sophistication and frequency of cyberattacks. Today, Microsoft is announcing that we have entered in...

Workreap < 2.2.2 - Missing Authorization Checks in Ajax Actions

The theme had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site. log in as arbitrary freelancer...

PT-2021-3990

Name of the Vulnerable Software and Affected Versions Portfolio Responsive Gallery WordPress plugin versions prior to 1.1.8 Description The issue is related to the implementation of the get portfolios and get portfolio attributes functions in the Portfolio Responsive Gallery WordPress plugin. It ...

Portfolio Responsive Gallery < 1.1.8 - Authenticated Blind SQL Injections

The getportfolios and getportfolioattributes functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to...

WordPress Portfolio Responsive Gallery plugin <= 1.1.7 - Authenticated Blind SQL Injection (SQLi) vulnerability

Authenticated Blind SQL Injection SQLi vulnerability discovered by To Quang Duong in WordPress Portfolio Responsive Gallery plugin versions = 1.1.7. Solution Update the WordPress Portfolio Responsive Gallery plugin to the latest available version at least 1.1.8...

Wordpress Themify Portfolio Post Cross-Site Scripting Vulnerability

Wordpress Themify Portfolio Post is Wordpress an open source application plugin . Provide a neat layout to display project information features . A cross-site scripting vulnerability exists in Themify Portfolio Post WordPress plugin versions prior to 1.1.6. The vulnerability stems from the progra...

CVE-2021-24129

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...

CVE-2021-24129

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...

Cross site scripting

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...

CVE-2021-24129

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...

CVE-2021-24129 Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...

CVE-2021-24129

The CVE-2021-24129 entry concerns the WordPress Themify Portfolio Post plugin. Affected: versions before 1.1.6. Root cause: unvalidated input and lack of output encoding in the plugin, enabling Stored Cross-Site Scripting (XSS). Impact: low-privilege users (Contributor+) can inject JavaScript/HTM...

CVE-2021-24129: Improper Neutralization of Input During Web Page Generation

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...