Cross site request forgery (csrf)

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link...

Cross site request forgery (csrf)

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite t...

Cross site scripting

The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreonsaveattachmentpatreonlevel AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is...

Arbitrary file deletion

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...

CVE-2020-15942

An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile...

CVE-2021-24231 Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link...

CVE-2021-24230

Vulnerability (CVE-2021-24230) is a CSRF in the Patreon WordPress plugin prior to 1.7.0. An authenticated attacker visiting a page could cause a logged-in user to overwrite or create arbitrary user metadata, specifically the wp_capabilities meta, altering the user’s roles and privileges and poten...

CVE-2021-24228 Patreon WordPress < 1.7.2 - Reflected XSS on Login Form

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...

CVE-2021-24228

Patreon WordPress Plugin

CVE-2021-24227

Patreon WordPress plugin

CVE-2020-15942: Insufficiently Protected Credentials

An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile...

Debian DSA-4886-1 : chromium - security update

Several vulnerabilites have been discovered in the chromium web browser. - CVE-2021-21159 Khalil Zhani discovered a buffer overflow issue in the tab implementation. - CVE-2021-21160 Marcin Noga discovered a buffer overflow issue in WebAudio. - CVE-2021-21161 Khalil Zhani discovered a buffer...

Vulnerability fixed in FortiWeb

A vulnerability has been fixed in FortiWeb. An authenticated malicious party could exploit the vulnerability to obtain plaintext passwords for systems configured via a Web Vulnerability Scan profile. FortiNet has released updates to fix the vulnerability in FortiWeb. For more information, see:...

The password configured in the FortiWeb's Web Vulnerability Scan profile is visible in cleartext.

...

PT-2021-7468

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.2.x through 6.2.3 FortiWeb versions 6.3.x through 6.3.4 Description An information disclosure issue in the Web Vulnerability Scan profile of Fortinet's FortiWeb may allow a remote authenticated attacker to read the password...

DEBIAN-CVE-2021-23982

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR 78.9, Firefox 87, and Thunderbird 78.9...

CVE-2021-23982

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR 78.9, Firefox 87, and Thunderbird 78.9...

CVE-2021-23982: Inadequate Encryption Strength

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR 78.9, Firefox 87, and Thunderbird 78.9...

The vulnerability of Trend Micro’s Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) lies in improper resource cleanup or release mechanisms. This allows attackers to cause the software to crash or fail to perform its functions.

The vulnerability of Trend Micro’s Virus Scan API VSAPI and Advanced Threat Scan Engine ATSE lies in improper resource cleanup or release. Exploiting this vulnerability can allow an attacker to cause the software to crash or experience service failures due to a specially created file...

CVE-2021-28670

Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow unauthorized users, by leveraging the Scan To Mailbox feature, to delete arbitrary files from the disk...