CVE-2021-24840

The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the queryvars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request...

PT-2021-16091

Name of the Vulnerable Software and Affected Versions WPSchoolPress WordPress plugin versions prior to 2.1.10 Description The issue arises from the improper sanitization or use of prepared statements for POST variables in SQL queries, leading to SQL injection. This affects multiple actions...

Google TensorFlow security vulnerabilities

A security vulnerability in Google TensorFlow, an end-to-end open source platform for machine learning from Google, stems from the use of uninitialized variables in the Grappler optimizer. If the trainnodes vector obtained from the saved optimization model does not contain Dequeue nodes, then...

Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 3

In our first post in this series, we covered the setup of Rapid7's hands-on exercise at Defcon 29's IoT Village. Last week, we discussed how to determine the UART status of the header we created and how to actually start hacking on the IoT device. The goal in this next phase of the IoT hacking...

YouPHPTube code injection vulnerability

YouPHPTube is a PHP-based video website system. YouPHPTube has a security vulnerability that originates from an administrator privileged user being able to write files on the file system using flags and code variables in file save.php...

CVE-2021-25877: Improper Control of Generation of Code

AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php...

Microsoft finds new macOS vulnerability, Shrootless, that could bypass System Integrity Protection

Microsoft has discovered a vulnerability that could allow an attacker to bypass System Integrity Protection SIP in macOS and perform arbitrary operations on a device. We also found a similar technique that could allow an attacker to elevate their privileges to root an affected device. We shared...

NewStart CGSL MAIN 6.02 : bash Multiple Vulnerabilities (NS-SA-2021-0118)

The remote NewStart CGSL host, running version MAIN 6.02, has bash packages installed that are affected by multiple vulnerabilities: - GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remot...

Remote Code Execution (RCE)

Gradle is vulnerable to remote code execution. start scripts generated by the application plugin and the gradlew script are both vulnerable to arbitrary code execution when an attacker is able to change environment variables for the user running the script. This may impact those who use gradlew o...

CVE-2020-23038

Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables...

CVE-2020-23038

Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables...

CVE-2020-23038

CVE-2020-23038 affects Swift File Transfer Mobile v1.1.2 and earlier. A path traversal/info-disclosure vulnerability exists in the path parameter, triggered by an error caused by including non-existent path environment variables. The connected sources corroborate that an unauthorized attacker cou...

CVE-2021-42536

The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables...

CVE-2021-42536

The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables...

Default credentials

The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables...

CVE-2021-42536

The CVE-2021-42536 vulnerability affects Emerson WirelessHART Gateway devices. It allows disclosure of peer usernames and passwords by permitting all users to read global variables, impacting confidentiality (CVE-2021-42536). Reported impacts include high confidentiality exposure with network-rem...

CVE-2021-42536 Emerson WirelessHART Gateway

The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables...

Emerson WirelessHART Gateway information leakage vulnerability

The Emerson WirelessHART Gateway is a wireless gateway from Emerson Corporation. An information disclosure vulnerability exists in Emerson WirelessHART Gateway, which stems from the ability to read global variables by allowing all users access, making it easy for affected products to disclose pee...

CVE-2021-42536: Exposure of Sensitive Information to an Unauthorized Actor

The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables...

PT-2021-23615

Name of the Vulnerable Software and Affected Versions Product affected versions not specified Description The issue allows all users access to read global variables, resulting in the disclosure of peer username and password. Recommendations At the moment, there is no information about a newer...