WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. Get Custom Field Values Plugin is a WordPress open source application plugin. WordPress Get Custom Field Values Plugin...

PT-2021-16346

Name of the Vulnerable Software and Affected Versions: Get Custom Field Values WordPress plugin versions prior to 4.0 Description: The issue allows users with a role as low as Contributor to access other posts metadata without validating the permissions. For example, contributors can access admin...

CVE-2021-24872: Incorrect Authorization

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata...

CVE-2021-24871: Improper Neutralization of Input During Web Page Generation

The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

PT-2021-16345

Name of the Vulnerable Software and Affected Versions: Get Custom Field Values WordPress plugin versions prior to 4.0.1 Description: The issue allows users with a role as low as contributor to perform Cross-Site Scripting attacks due to the plugin not escaping custom fields before outputting them...

Reentrancy vulnerability in Basket contract's initialize() method.

Handle broccolirob Vulnerability details A malicious "publisher" can create a basket proposal that mixes real ERC20 tokens with a malicious ERC20 token containing a reentrancy callback in it's approve method. When the initialize method is called on the newly cloned Basket contract, a method calle...

Cisco Webex Player Code Execution

The vulnerability of the Cisco Webex Player for Windows and MacOS operating systems is related to insufficient checking of values in Webex recording files. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted WRF Webex Recording Format files...

SUSE SLES15 Security Update : nodejs12 (SUSE-SU-2021:3940-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3940-1 advisory. - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers bsc1191601. - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing...

SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2021:3886-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3886-1 advisory. nodejs14 was updated to 14.18.1: deps: update llhttp to 2.1.4 Security fixes: - HTTP Request Smuggling due to spaced in headers bsc1191601,...

VMware InstallBuilder Randomness

The vulnerability of the VMware InstallBuilder tool for developing and automating installer installations on Windows operating systems is related to the use of insufficiently random values. Exploiting this vulnerability could allow a remote attacker to gain increased privileges...

Html2Csv code injection vulnerability

Html2Csv is an open source utility. It is used to extract tables from Html documents and convert them to Csv format. html2csv suffers from a security vulnerability that stems from the fact that when a formula is embedded in an HTML page, the formula will be accepted without any validation and...

CVE-2021-38873

IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 208396...

PT-2021-23230 · Symfony +2 · Symfony +2

Name of the Vulnerable Software and Affected Versions: Symfony versions 4.1.0 through 4.4.34 Symfony versions 5.0.0 through 5.3.11 Description: CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any...

Sensio Labs Symfony security vulnerabilities

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools that can be used to quickly create complex web programs. Symfony suffers from a security vulnerability that stem...

CVE-2021-36334

Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to arbitrary code execution on end user machine...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

IBM Planning Analytics injection vulnerability

IBM Planning Analytics is a business planning and analysis solution from IBM Corporation. The solution supports automated execution of business planning, budgeting, and analysis processes.IBM Planning Analytics has a security vulnerability that stems from incorrect validation of csv file content...

freerdp security update

2:2.2.0-7 - Updated: Refactored RPC gateway parser rhbz2017948 + fixed issues discovered by Covscan 2:2.2.0-6 - Refactored RPC gateway parser rhbz2017948 2:2.2.0-5 - Revert: Refactored RPC gateway parser rhbz2017948 2:2.2.0-4 - Refactored RPC gateway parser rhbz2017948 2:2.2.0-3 - Add checks for...

Information disclosure

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

PT-2021-23699

Name of the Vulnerable Software and Affected Versions Zoho Remote Access Plus Server Windows Desktop Binary versions prior to 10.1.2121.1 Description The issue is related to incorrect access control, where the installation directory has weak file permissions, allowing full control for the Windows...