Multilist Subscribe for Sendy <= 1.6.1 - Subscriber+ Arbitrary Options Update

The plugin is using an outdated version of the Freemius library 1.2.2.9, which is known to be affected by a security issue allowing any authenticated users, such as subscriber to set arbitrary blog options As any authenticated user: Enable new user registrations:...

PJSIP 资源管理错误漏洞

PJSIP is a free and open source multimedia communications library written in C that implements standards-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. PJSIP suffers from a Resource Management Error vulnerability that stems from the fact that in versions prior to 2.11.1, in a dialog...

keycloak-services: POST based reflected Cross Site Scripting vulnerability

A flaw has been found in Keycloak. The clients-registrations endpoint allows execution of javascript code on the client-side, which makes it vulnerable to a Cross-Site Scripting attack...

CVE-2021-20323

A flaw has been found in Keycloak. The clients-registrations endpoint allows execution of javascript code on the client-side, which makes it vulnerable to a Cross-Site Scripting attack...

CVE-2021-25083

The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25083

The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25083

CVE-2021-25083 affects the WordPress plugin Registrations for the Events Calendar (versions before 2.7.10). The issue is that the qtype parameter is not escaped before being echoed back in an attribute on the settings page, causing a reflected XSS vulnerability. Impact is client-side JavaScript e...

PT-2025-8066

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists due to the registration of devices multiple times when multiple connection complete events are received for the same handle. To address this, the code no...

CVE-2021-24876

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24876 Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

GSD-2021-1002191 cfg80211: fix management registrations locking

cfg80211: fix management registrations locking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15 by commit...

UVI-2021-1002191 cfg80211: fix management registrations locking

cfg80211: fix management registrations locking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15 by commit...

GSD-2021-1002122 cfg80211: fix management registrations locking

cfg80211: fix management registrations locking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.16 by commit...

GSD-2021-1002059 cfg80211: fix management registrations locking

cfg80211: fix management registrations locking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.77 by commit...

UVI-2021-1002059 cfg80211: fix management registrations locking

cfg80211: fix management registrations locking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.77 by commit...

WordPress Registrations for the Events Calendar plugin <= 2.7.5 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress Registrations for the Events Calendar plugin versions = 2.7.5. Solution Update the WordPress Registrations for the Events Calendar plugin to the latest available version at least 2.7.6...

The vulnerability of the configuration comparison function of the software tool for interacting with servers via CURL, related to the use of a name with an incorrect reference, allows attackers to access confidential data.

The vulnerability of the configuration comparison function of the software tool for interacting with servers via CURL is related to the comparison of paths without considering registrations. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...

WordPress Registrations for the Events Calendar plugin <= 2.7.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Registrations for the Events Calendar plugin versions = 2.7.4. Solution Update the WordPress Registrations for the Events Calendar plugin to the latest available version at least 2.7.5...

Glewlwyd SSO server 缓冲区错误漏洞

The Glewlwyd SSO server is a single sign-on SSO server for multi-factor authentication for OAuth2 and OpenID Connect authentication. A security vulnerability exists in Glewlwyd SSO server 2.5.3, which stems from a buffer overflow in scheme/webauthn.c during FIDO2 signature validation in webauthn...

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component

There is functionality in the plugin to add file uploads to user registrations and profile updates that had no file type checking in place making it possible for arbitrary files to be uploaded. PoC fh = open'shell.php', 'wb' fh.writeb'\xFF\xD8\xFF\xE0' + b'' fh.close 'Hax0r', 'regemail' =...