4889 matches found
CVE-2021-22963
A redirect vulnerability in the fastify-static module version 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: tru...
CVE-2021-33726
A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory...
CVE-2021-24656
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts depending on the settings used, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml...
CVE-2021-35059
OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter...
WordPress plugin cross-site scripting vulnerabilities
WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Weather Effect, which stems from the Weather Effect WordPress plugin prior to 1.3.6 not properly validating and escaping some settings e.g. size leaf, flake lea...
CVE-2021-37965
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2021-37974
Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page...
UBUNTU-CVE-2021-30626
Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2021-40324
Cobbler before 3.3.0 allows arbitrary file write operations via uploadlogdata...
Multipass security vulnerabilities
Multipass is a lightweight vm manager for Linux, Windows and MacOS. A security vulnerability exists in Multipass versions for Windows prior to 1.7.0 that allows privilege escalation...
CVE-2021-36366
Nagios XI before 5.8.5 incorrectly allows manageservices.sh wildcards...
CVE-2021-41540
A vulnerability has been identified in Solid Edge SE2021 All versions SE2021MP8. The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process ZDI-CAN-13776...
CVE-2021-37761
Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution...
Asus Rog Armory Crate code issue vulnerabilities
Asus Rog Armory Crate is a one-stop application from Asus China Inc. for connecting, configuring and controlling a vast array of Rog gaming products. A security vulnerability exists in Asus Rog Armory Crate Lite versions prior to 4.2.10, which stems from the software previously allowing local use...
CVE-2021-41586
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password...
CVE-2021-23443
This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array instead of a string or a SafeValue, even if are used...
CVE-2021-37420
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing...
CVE-2021-37741
ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities...
PT-2021-16151 · WordPress · Visual Link Preview
Name of the Vulnerable Software and Affected Versions: Visual Link Preview WordPress plugin versions prior to 2.2.3 Description: The issue allows any authenticated user to call several AJAX actions without proper authorization, due to the CSRF nonce being displayed for all authenticated users. Th...