USN-4649-2: xdg-utils regression

USN-4649-1 fixed vulnerabilities in xdg-utils. That update caused a regression by removing the --attach functionality in thunderbird and others applications. This update fix the problem by reverting these changes. Original advisory details: Jens Mueller discovered that xdg-utils incorrectly handl...

CVE-2020-24701

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI...

PT-2021-11068 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for XSS via the app loading mechanism, specifically through the PATH INFO to the "/appsuite" URI. Recommendations: For OX App Suite versions 7.10.4 and earlier, update to ...

CVE-2021-3111

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI...

CVE-2020-24577

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body...

CVE-2020-24577

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body...

PT-2021-7945

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 112 Firefox for Android versions prior to 112 Focus for Android versions prior to 112 Description A vulnerability in the WebExtension component of the Firefox browser is related to the disclosure of information in an...

Genivia gSOAP WS-Addressing plugin code execution vulnerability

Summary A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Genivia gSOAP 2.8.107 Product...

CVE-2021-21495

MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executarcentral.php?acao=altsenhaprinc URI...

CVE-2021-21495

MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executarcentral.php?acao=altsenhaprinc URI...

CVE-2021-21495

CVE-2021-21495 affects MK-AUTH up to version 19.01 K4.9, where a Cross-Site Request Forgery (CSRF) enables password changes via the URI central/executar_central.php?acao=altsenha_princ. The connected sources consistently describe the vulnerability as a CSRF flaw affecting the password-change func...

CVE-2021-3005

MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information e.g., a CPF number via a modified titulo aka invoice number value to the central/recibo.php URI...

Design/Logic Flaw

MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information e.g., a CPF number via a modified titulo aka invoice number value to the central/recibo.php URI...

CVE-2020-35930

Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI...

CVE-2020-35930

Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI...

CVE-2020-35735

Vidyo 02-09-/D allows clickjacking via the portal/ URI...

CVE-2020-35735

Vidyo 02-09-/D allows clickjacking via the portal/ URI...

PT-2020-17407

Name of the Vulnerable Software and Affected Versions Vidyo versions 02-09-/D Description The issue allows clickjacking via the portal/ URI. Recommendations For Vidyo versions 02-09-/D, as a temporary workaround, consider restricting access to the portal/ URI until a patch is available...

CVE-2020-35735: Improper Restriction of Rendered UI Layers or Frames

Vidyo 02-09-/D allows clickjacking via the portal/ URI...

Design/Logic Flaw

Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel which will require a physical reset to restore administrative control via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/setfactory URI...