CVE-2021-32104

A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...

kernel: powerpc: guest can cause DoS on POWER9 KVM hosts

A flaw was found in the way Linux kernel running on the Power9 processor saves and restores its registers while going in and coming out of an idle state. The issue occurs when a guest kernel has Kernel Userspace Address Protection KUAP feature enabled. The idlebook3s function does not save and...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

Design/Logic Flaw

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

CVE-2021-31803 affects cPanel prior to 94.0.3, enabling a self‑XSS via the EasyApache 4 Save Profile (SEC-581). The issue lies in saving a configuration file without adequately filtering user input, allowing an attacker to inject JavaScript. Affected component/flow is the EasyApache 4 Save Profil...

CVE-2021-31803: Improper Neutralization of Input During Web Page Generation

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

Cpanel 跨站脚本漏洞

Cpanel is a set of Web-based automated colocation platform from Cpanel, Inc. in the United States. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in cPanel versions prior to 94.0.3. The vulnerability stems from saving...

CVE-2021-31583: Improper Neutralization of Input During Web Page Generation

Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in...

PT-2021-19431 · Sipwise · Sipwise C5 Ngcp Www Admin

Name of the Vulnerable Software and Affected Versions: Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 Description: The issue concerns multiple authenticated stored and reflected XSS vulnerabilities. These occur when input passed via several parameters to...

Solarwinds Orion Platform 安全漏洞

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. An...

CVE-2021-23279

Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in metadriversrv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete...

WordPress Content Copy Protection & Prevent Image Save <= 1.3 - Authenticated Cross-Site Request Forgery (CSRF) vulnerability

Authenticated Cross-Site Request Forgery CSRF vulnerability discovered by m0ze in WordPress Content Copy Protection & Prevent Image Save versions = 1.3. Solution This plugin has been closed as of April 5, 2021 and is not available for download. This closure is temporary, pending a full review...

Content Copy Protection & Prevent Image Save <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)

The plugin does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them. PoC -- PoC 1 | Authenticated Persistent XSS & XFS | Image saving disabled message text: ! POST...

WordPress Content Copy Protection & Prevent Image Save plugin <= 1.3 - Authenticated Persistent XSS & XFS vulnerabilities

Authenticated Persistent XSS & XFS vulnerabilities discovered by m0ze in WordPress Content Copy Protection & Prevent Image Save plugin versions = 1.3. Solution This plugin has been closed as of April 5, 2021 and is not available for download. This closure is temporary, pending a full review...

CVE-2021-24206

In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget includes/widgets/image-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a...

CVE-2021-24204

In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget includes/widgets/accordion.php accepts a ‘titlehtmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a...

CVE-2021-24205

In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifi...