Updated libtpms/swtpm packages fix security vulnerability

CryptSym: fix AES output IV CVE-2021-3505. Fixed a context save and suspend/resume problem when public keys are loaded. Reset too large size indicators in TPM2B to avoid access beyond buffer CVE-2021-3623 Restore original value in buffer if unmarshalled one was illegal Fixed out-of-bounds access...

PT-2021-16387

Name of the Vulnerable Software and Affected Versions: WordPress Download Manager versions prior to 3.2.22 Description: The issue concerns the lack of sanitization and escaping of Template data, which is then outputted in various pages, including the admin dashboard and frontend. Additionally, th...

PT-2021-7988

Name of the Vulnerable Software and Affected Versions Emerson Dixell XWEB-500 affected versions not specified Description The issue is related to an arbitrary file write vulnerability in the /cgi-bin/logo extra upload.cgi, /cgi-bin/cal save.cgi, and /cgi-bin/lo utils.cgi API endpoints. This...

Django -- multiple vulnerabilities

Django Release reports: CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator. CVE-2021-45116: Potential information disclosure in dictsort template filter. CVE-2021-45452: Potential directory-traversal via Storage.save...

CVE-2021-42367

The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the /includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization...

PT-2021-23598 · WordPress · Variation Swatches For Woocommerce

Name of the Vulnerable Software and Affected Versions: Variation Swatches for WooCommerce WordPress plugin versions up to and including 2.1.1 Description: The issue allows attackers to inject arbitrary web scripts via several parameters in the /includes/class-menu-page.php file, due to missing...

WordPress plugin security vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. cross-site scripting vulnerability exists in the...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-24818

The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

PT-2021-16287

Name of the Vulnerable Software and Affected Versions: Shiny Buttons WordPress plugin versions 1.1.0 and earlier Description: The issue concerns the lack of authorization and CSRF protection when saving a template, specifically through the wpbtn save template function hooked to the init action...

CVE-2020-19682

A Cross Site Request Forgery CSRF vulnerability exits in ZZZCMS V1.7.1 via the saveuser funciton in save.php...

ZZCMS Cross-Site Request Forgery Vulnerability

ZZCMS is a content management system CMS by China Zzcms team. ZZZCMS V1.7.1 suffers from a cross-site request forgery vulnerability, which stems from the lack of token validation for cross-site request forgery in the saveuser function in save.php...

ZZCMS Cross-Site Scripting Vulnerabilities

ZZZCMS is a content management system CMS from the ZZZCMS team in China. ZZZCMS suffers from a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the editfile action of /adminxxx/save.php. An attacker could exploit the...

PT-2021-10387

Name of the Vulnerable Software and Affected Versions: ZZZCMS version 1.7.1 Description: A Cross Site Request Forgery CSRF issue exists via the save user function in the "save.php" endpoint. This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For ZZZCMS...

showdoc Cross-site Request Forgery Vulnerability (CNVD-2021-94821)

showdoc is an open source tool for IT teams to share documents online. showdoc is vulnerable to cross-site request forgery, which can be exploited by attackers via "/server/index.php?s=/api/itemGroup/save"...

showdoc Cross-Site Request Forgery Vulnerability

showdoc is an open source tool for IT teams to share documents online. showdoc is vulnerable to cross-site request forgery, which can be exploited by attackers via "/server/index.php?s=/api/itemGroup/save"...

orangescrum 1.8.0 - (Multiple) Cross-Site Scripting Vulnerability

Exploit Title: orangescrum 1.8.0 - 'Multiple' Cross-Site Scripting XSS Authenticated Exploit Author: Hubert Wojciechowski Contact Author: email protected Company: https://redteam.pl Vendor Homepage: https://www.orangescrum.org/ Software Link: https://www.orangescrum.org/ Version: 1.8.0 Testeted o...

CVE-2021-24853

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qrsavebulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects...

CVE-2021-24853

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qrsavebulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects...