CVE-2021-36791

The datednews aka Dated News extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data...

CVE-2021-36791

CVE-2021-36791 affects the TYPO3 Dated News extension (dated_news) up to version 5.1.1, enabling information disclosure of application registration data. The available sources (NVD/Red Hat/CVE records and TYPO3 advisory) confirm the vulnerability and affected component but do not include explicit...

Easy-Mock 1.6.0 Remote Code Execution

Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Date: 12/08/2021 Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json...

CVE-2021-36927

Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability...

CVE-2021-36927

Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability...

CVE-2021-36927

Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability...

Update 17.9 for Microsoft Dynamics 365 Business Central 2020 Release Wave 2 (Application Build 17.9.28504, Platform Build 17.0.28458)

None None...

Mozilla Firefox和Mozilla Thunderbird输入验证错误漏洞

Mozilla Firefox and Mozilla Thunderbird are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source Web browser. Mozilla Thunderbird is a separate set of email client software. The software supports IMAP and POP email protocols as well as HTML email formats. Mozilla...

Multiple vulnerabilities in Extension "Dated News" (dated_news)

The extension fails to properly encode user input for output in HTML context CVE-2021-36790 and contains a blind SQL injection vulnerability CVE-2021-36789. It is also possible to confirm various applications CVE-2021-36792 and thereby obtain all application registration data CVE-2021-36791...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:1142-1 Rating: important References: 1065729 1085224 1094840 1113295 1153274 1154353 1156395 1179243 1183871 1184114 1184350 1184631 1185377 1185902 1186194 1186264 1186482 1187476 1188101 1188405...

PT-2021-4039 · Microsoft · Windows Digital Tv Tuner Device Registration Application +1

Name of the Vulnerable Software and Affected Versions: Windows Digital TV Tuner device registration application affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Digital TV Tuner device registration application, which can be...

The vulnerability of the command-line interface of Cisco SD-WAN micro-programming software allows a hacker to read arbitrary files or gain unauthorized access to the device.

The vulnerability of the command-line interface of Cisco SD-WAN software lies in the insufficient protection of registration data. Exploiting this vulnerability allows an attacker to read arbitrary files or gain unauthorized access to the device...

CVE-2021-24522

The User Registration, User Profile, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places...

Code injection

The User Registration, User Profile, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places...

CVE-2021-24522

CVE-2021-24522 affects ProfilePress (formerly WP User Avatar) for WordPress, before version 3.1.11. The tabbed login/register widget is vulnerable to unauthenticated reflected XSS due to improper escaping, with some cases enabling replication via $_GET because $_POST values were mapped to $_GET. ...

ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget

The plugin's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $POST as $GET which meant that in some cases this could be replicated with just $GET parameters and no need...

Mitsubishi Electric MELSEC iQ-R series 访问控制错误漏洞

The Mitsubishi Electric MELSEC iQ-R series is a programmable logic controller from Mitsubishi Electric Corporation Mitsubishi Electric. An access control error vulnerability exists in the Mitsubishi Electric MELSEC iQ-R series of products. The vulnerability arises from a product that does not hav...

Cross site scripting

The User Registration, User Profiles, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript...

Cross site scripting

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfilteredhtml capability is disallowed, leading to an...

CVE-2021-24450 ProfilePress < 3.1.8 - Authenticated Stored XSS

The User Registration, User Profiles, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript...