CVE-2021-29242: Improper Input Validation

CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages...

.transfer is not safe to use with custom smart contracts

Handle paulius.eth Vulnerability details Impact .transfer is used for transferring ether. It is no longer recommended as recipients with custom fallback functions smart contracts will not be able to handle that. You can read more here: Recommended Mitigation Steps Solution don't forget re-entranc...

Denial Of Service (DoS)

asterisk, edge is vulnerable to denial of service. It allows an attacker to trigger a crash by sending a declined stream in a response re-invite initiated by Asterisk...

CVE-2021-26073

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

CVE-2021-26074

Broken Authentication in Atlassian Connect Spring Boot ACSB from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a...

CVE-2021-26073

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

PT-2021-16940 · Atlassian · Connect Express

Name of the Vulnerable Software and Affected Versions: Atlassian Connect Express versions 3.0.2 through 6.6.0 Description: The issue concerns broken authentication in Atlassian Connect Express, a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and th...

CVE-2021-26073: Improper Authentication

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

CVE-2021-26074: Improper Authentication

Broken Authentication in Atlassian Connect Spring Boot ACSB from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a...

Re-entrancy bug in MarginRouter.crossSwapTokensForExactTokens allows inflating balance

Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details One can call the MarginRouter.crossSwapExactTokensForTokens function first with a fake contract disguised as a token pair: crossSwapExactTokensForTokens0.0001 WETH, 0,...

PT-2021-6449

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 16.19.1 Asterisk versions prior to 18.5.1 Description The issue is related to the incorrect handling of a re-INVITE after a BYE request has been sent. This can be exploited by a remote attacker, allowing them to caus...

UBUNTU-CVE-2021-29266

An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v-configctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0...

MangaDex Site Offline Following Hacking Incident

MangaDex, the online repository of manga animation comics, will be closed until further notice following a hacking incident. Last week, the site reported that a cyberattacker had gained access to an administrative account, “through the reuse of a session token found in an old database leak throug...

CVE-2021-24137

Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands...

Sql injection

Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands...

CVE-2021-24137

CVE-2021-24137 affects the WordPress Blog2Social plugin prior to 6.3.1. Unvalidated input in the Re-Share Posts feature allows authenticated users to perform SQL injection, enabling arbitrary SQL execution against the database. The vulnerability is exploitable via the plugin’s Re-Share Posts flow...

PT-2021-15682

Name of the Vulnerable Software and Affected Versions: Blog2Social WordPress plugin versions prior to 6.3.1 Description: The issue concerns unvalidated input in the Blog2Social WordPress plugin, leading to SQL Injection in the Re-Share Posts feature. This allows authenticated users to inject...

Wordpress Blog2Social SQL注入漏洞

Wordpress Blog2Social is an application plugin for Wordpress. Provides an automatic posting and updating feature. A SQL injection vulnerability exists in WordPress Blog2Social plugin versions prior to 6.3.1, which stems from the fact that unauthenticated input can lead to SQL injection in the...

CVE-2021-24137: Improper Neutralization of Special Elements used in an SQL Command

Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands...

Insecure Session Management

keycloak-core uses an insecure session management. The application does not require re-authentication upon a successful password change. in the event where an existing session can be obtained by an attacker, a password change will not cause the attacker's session to be invalidated...