Race condition in Apache Tomcat

The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is...

Lansweeper 跨站脚本漏洞

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery, network settings scanning, etc. A cross-site scripting vulnerability exists in Lansweeper 9.1.20.2, which stems from a failure to adequately clean user-supplied data in...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build a database to fully manage IT computers, monitors, servers, printers, network devices, phones, even toner cartridges...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to a resource management error that could be exploited by attackers to convince users to engage in specific user interactions to exploit heap corruption via carefully designed HTML pages...

zzcms cross-site scripting vulnerability

ZZCMS is a content management system CMS by Zzcms team in China. A cross-site scripting vulnerability exists in zzcms, which stems from a lack of effective filtering and escaping of modified user actions in ad.php in the software. No details of the vulnerability are available at this time...

Mozilla Firefox Security Advisory (MFSA2016-43) - Deprecated

This host is missing a security update for Mozilla Firefox. This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Uffizio GPS Tracker 跨站脚本漏洞

Uffizio Gps Tracker is a Gps tracker from Uffizio India. Uffizio GPS Tracker suffers from a cross-site scripting vulnerability that can be exploited by an attacker to gain access to the host computer to view sensitive information, obtain code execution, cause a redirect to an arbitrary external...

DEBIAN-CVE-2021-3731

LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions...

in erikdubbelboer/phpredisadmin

✍️ Description It can be possible to perform a clickjacking attack due to the lack of frame restrictions. The application does not set the response header X-Frame-Options: DENY. 🕵️‍♂️ Proof of Concept 💥 Impact According to PortSwigger references, it is possible for a page controlled by an attacker...

Filter Gallery < 0.0.7 - Unauthorised AJAX Calls

The plugin had a logic flaw in the CSRF checks of its AJAX calls, allowing them to be passed by not providing the related parameter in the request. This could allow attacker to make logged in users do unwanted actions. Furthermore, the AJAX calls are also lacking capability checks, allowing any...

Swiss Army knife For Information Security: What is Comprehensive Protection?

Written by Sergey Ozhegov, CEO of SearchInform In the early days of information security, we used to rely on antivirus and firewall in our arsenal. Once I even “caught” a leak with the help of the firewall logs: I noticed an atypically large data upload and found out that the user was uploading...

CVE-2021-25380

Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user...

CVE-2021-25380

Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the user...

Samsung Bixby 安全漏洞

Samsung Bixby Voice is an application from the South Korean company Samsung. It provides a voice recognition function. A security vulnerability exists in Bixby prior to version 3.0.53.02, which stems from mishandling of exceptions in Bixby prior to version 3.0.53.02, and can be exploited by an...

PT-2021-16571 · Samsung · Bixby

Name of the Vulnerable Software and Affected Versions: Bixby versions prior to 3.0.53.02 Description: The issue arises from improper handling of exceptional conditions, allowing an attacker to execute actions registered by the user. Recommendations: For versions prior to 3.0.53.02, update to...

CVE-2020-13421

OpenIAM before 4.2.0.3 is affected by an Incorrect Access Control vulnerability in the Create User, Modify User Permissions, and Password Reset actions. The CVE entry is supported by multiple sources (NVD entry CVE-2020-13421; CNVD/CNNVD references) confirming the affected product and version ran...

Cross site request forgery (csrf)

The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups...

CVE-2021-1257 Cisco DNA Center Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The...

IBM Cloud Pak System 跨站请求伪造漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A cross-site request forgery vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit this vulnerability to perform malicious and unauthorized actions...

MediaWiki <= 1.35.0 Multiple Vulnerabilities - Windows

MediaWiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...