CVE-2022-20225

In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Moderate: Red Hat Security Advisory: Satellite 6.11 Release

An update is now available for Red Hat Satellite 6.11 Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fixes: libsolv: Heap-based buff...

Toll fraud malware: How an Android application can drain your wallet

Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...

Toll fraud malware: How an Android application can drain your wallet

Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...

WordPress Icegram plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. icegram is a subscription plugin used in it. WordPress plugin is an...

WordPress Mail Subscribe List plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. cross-site request forgery vulnerability exists in versions of the WordPress Mail Subscribe List plugin...

Malicious code in @harrysforge/subscription-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eeb0818128e208753abf921655ed58e1a0ed6aa71121cbad66a8a2549655854 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DDoS-for-hire service provider jailed

Matthew Gatrel, a 33-year-old man from St. Charles, Illinois, has been sentenced to two years in prison for running websites that provide powerful distributed denial-of-service DDoS attacks against internet users and websites. This sentencing resulted in the seizure of his websites, making the...

Popup Builder < 4.1.11 - Admin+ Stored Cross-Site Scripting

The plugin does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltredhtml is disallowed Create/edit a subscription, enabled the GDPR options in it and add the following payload in the "confirmation text"...

Popup Builder < 4.1.11 - Admin+ Stored Cross-Site Scripting

The plugin does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltredhtml is disallowed PoC Create/edit a subscription, enabled the GDPR options in it and add the following payload in the "confirmation text"...

CVE-2021-41415

Subscription-Manager v1.0 /main.js has a cross-site scripting XSS vulnerability in the machineDetail parameter...

CVE-2021-41415

Subscription-Manager v1.0 /main.js has a cross-site scripting XSS vulnerability in the machineDetail parameter...

CVE-2021-41415

Subscription-Manager v1.0 /main.js has a cross-site scripting XSS vulnerability in the machineDetail parameter...

Cross site scripting

Subscription-Manager v1.0 /main.js has a cross-site scripting XSS vulnerability in the machineDetail parameter...

CVE-2021-41415

Subscription-Manager v1.0 /main.js has a cross-site scripting XSS vulnerability in the machineDetail parameter...

CVE-2021-41415

CVE-2021-41415 affects Subscription-Manager v1.0, involving a cross-site scripting (XSS) flaw in the machineDetail parameter of /main.js. Multiple sources indicate the root cause is insufficient filtering/escaping in the parameter, enabling injected scripts. The CVE details in NVD/NVD-derived rec...

Subscription-Manager 跨站脚本漏洞

Subscription-Manager is a subscription management system by the individual developer of China's JiYouRan youranreus. A cross-site scripting vulnerability exists in Subscription-Manager v1.0, which stems from a lack of filtering and escaping of the machineDetail parameter in /main.js...

Microsoft Office 安全漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office. The following products and versions are...

Microsoft Office 安全漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office. The following products and versions are...

Security Updates for Microsoft SharePoint Server Subscription Edition (June 2022)

The Microsoft SharePoint Server Subscription Edition installation on the remote host on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute...