Simple Social Buttons < 3.2.0 - Reflected Cross-Site Scripting

Simple Social Buttons version 3.1.1 has a reflected Cross-Site Scripting vulnerability in the POST parameter "sharecounts". Both unauthenticated and authenticated attacks are possible Edit WPScanTeam The original report stated the issue as being fixed in 3.2.0, however a CSRF nonce has been added...

PT-2020-13593 · Nzxt · Nzxt Cam

Name of the Vulnerable Software and Affected Versions: NZXT CAM version 4.8.0 Description: An information disclosure issue exists in the WinRing0x64 Driver IRP 0x9c406144 functionality. A specially crafted I/O request packet IRP can cause the disclosure of sensitive information. An attacker can...

Kyland KPS2204 Code Issue Vulnerability

The Kyland KPS2204 is a programmable protocol converter developed for serial device networking applications by Kyland in Beijing, China. A security vulnerability exists in the Kyland KPS2204 6 Port Managed Din-Rail Programmable Device Servers Software Version:R0002.P05, which can be exploited by ...

OpenAsset Digital Asset Management SQL Injection

Title: Authenticated blind SQL injection SQLi Product: OpenAsset Digital Asset Management by OpenAsset Vendor Homepage: https://www.openasset.com/ Vulnerable Version: 12.0.19 Cloud 11.2.1 On-premise Fixed Version: 12.0.23 Cloud 11.4.10 On-premise CVE Number: CVE-2020-28860 Author: Jack Misiura fr...

CVE-2020-8286

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response...

Google Play Apps Remain Vulnerable to High-Severity Flaw

UPDATE Researchers are warning that several popular Google Play applications – including mobile browser app Edge – have yet to push out an important update addressing a high-severity vulnerability in the Google Play Core Library. The vulnerability exists in Google Play Core Library, which is...

CVE-2020-29392

The Estil Hill Lock Password Manager Safe app 2.3 for iOS has a 06 backdoor password. An attacker with physical access can unlock the password manager without knowing the master password set by the user...

DEBIAN-CVE-2020-7778

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

Directory traversal in development mode handler in Vaadin 14 and 15-17

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder. See CWE-20: Improper...

alkyne (0.1.0), dioxus-core (0.1.2) +7 more potentially affected by CVE-2020-36456 via toolshed (>=0.4.0, <=0.8.1)

toolshed CARGO version =0.4.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - vip-712 0.1.1 Source cves: CVE-2020-36456 Source advisory: OSV:RUSTSEC-2020-0136...

Microsoft Azure Sphere Unsigned Code Execution Vulnerability (CNVD-2021-17731)

Azure Sphere is a secure, advanced application platform with built-in communications and security features for connected devices. An unsigned code execution vulnerability exists in Microsoft Azure Sphere versions prior to 20.08. An attacker could exploit the vulnerability to execute code...

nginx Information Disclosure Vulnerability (CVE-2014-3556)

nginx is prone to an information disclosure vulnerability in the SMTP proxy. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

nginx 1.5.10 'ngx_http_spdy_module' RCE Vulnerability

nginx is prone to a remote code execution RCE vulnerability in the ngxhttpspdymodule module. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...

Security Bulletin: IBM Security Directory Suite vulnerable to information disclosure (CVE-2018-15473)

Summary Security vulnerability that could allow a remote attacker to obtain sensitive information, has been fixed and delivered in IBM Security Directory Suite. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused b...

Western Digital My Cloud Remote Code Execution Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A remote code execution vulnerability exists in Western Digital My Cloud Devices prior to version 5.4.1140, which originates from remote code execution due to insufficient user input validation in reg device.php. No...

Prototype Pollution in node-forge

Overview The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions. Recommendation Upgrade to version 0.10.0 or later. References -...

MetInfo SQL Injection Vulnerability (CNVD-2021-05409)

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. MetInfo 7.0.0 beta version has SQL injection vulnerability. Attackers can...

Mozilla Rust linked-hash-map buffer overflow vulnerability

Rust is a general-purpose, compiled programming language. A buffer overflow vulnerability exists in linked-hash-map in Mozilla Rust versions prior to 0.5.3, which arises from the initialization of a non-null pointer that can be exploited to execute arbitrary code with the help of a maliciously...

@cenk1cenk2/renovate-config (>=1.0.9, <=1.4.15) potentially affected by unknown CVE via renovate (>=21.33.15, <=22.25.6)

renovate NPM version =21.33.15, =1.0.9, =1.4.15 Source cves: unknown CVE Source advisory: OSV:GHSA-36RH-GGPR-J3GJ...

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using tags in the method descriptions. Recommendation Upgrade to version 2.2.1 or later...