1926 matches found
Design/Logic Flaw
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...
CVE-2021-31803
CVE-2021-31803 affects cPanel prior to 94.0.3, enabling a self‑XSS via the EasyApache 4 Save Profile (SEC-581). The issue lies in saving a configuration file without adequately filtering user input, allowing an attacker to inject JavaScript. Affected component/flow is the EasyApache 4 Save Profil...
CVE-2021-31803: Improper Neutralization of Input During Web Page Generation
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...
CVE-2021-25327
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...
Cross site request forgery (csrf)
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...
CVE-2021-25327
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...
CVE-2021-25327: Improper Neutralization of Input During Web Page Generation
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...
SKYWORTH Digital Technology RN510 跨站脚本漏洞
The RN510 is a dual-band wireless AC2100 access point from Skyworth Digital Technology. A cross-site request forgery vulnerability exists in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp in the Skyworth Digital Technology RN510 version V.3.1.0.4. No detailed vulnerability details are...
CVE-2021-25369
An improper access control vulnerability in seclog file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace...
A SpaceX Engineer's Dark Web Insider Trading Sparks SEC First
“MillionaireMike” allegedly ran a stock tip scam that earned him $27,000 in bitcoin payments...
Firewall Vendor Patches Critical Auth Bypass Flaw
Germany-based cybersecurity company Genua has fast-tracked a fix for a critical flaw in one of its firewall products. If exploited, the vulnerability could allow local attackers to bypass authentication measures and log in to internal company networks with the highest level of privileges. Genua...
Adobe Magento Commerce Cross Site Scripting
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Reflected Cross-Site Scripting XSS product: Adobe Magento Commerce vulnerable version: 2.4.2 fixed version: 2.4.2 CVE number: CVE-2021-21029 impact: Medium homepage:...
CVE-2021-26266
CVE-2021-26266 affects cPanel prior to 92.0.9. The issue allows a Reseller to bypass the suspension lock (SEC-578). The connected documents consistently describe the vulnerability in this product/version; no root-cause or exploit details are provided beyond the bypass of the suspension mechanism....
CVE-2021-26267
CVE-2021-26267 affects cPanel prior to 92.0.9. An MySQL user with an old-style password hash can bypass suspension (SEC-579). Remediation: update to cPanel 92.0.9 or later to resolve the issue. Exploitation status not provided in the supplied documents.
CVE-2021-26266: Undefined Security Weakness
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock SEC-578...
CVE-2021-3002: Improper Neutralization of Input During Web Page Generation
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter...
PT-2020-6819 · Samsung +1 · Samsung Mobile Devices +1
Name of the Vulnerable Software and Affected Versions: Samsung Mobile Devices versions prior to SMR MAR-2021 Release 1 Description: The issue is related to an improper access control vulnerability in the sec log file, which exposes sensitive kernel information to userspace. This vulnerability is...
CVE-2020-29135
cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...