CVE-2021-24572: Cross-Site Request Forgery (CSRF)

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could...

CVE-2021-24570: Cross-Site Request Forgery (CSRF)

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of t...

PT-2021-16089

Name of the Vulnerable Software and Affected Versions Accept Donations with PayPal WordPress plugin versions prior to 1.3.1 Description The issue arises from the lack of CSRF protection when deleting donation buttons, which are stored as posts. This allows an attacker to trick logged-in admins in...

Huawei Smartphone 后置链接漏洞

The Huawei Smartphone is a smartphone from the Chinese company Huawei. An authorization issue vulnerability exists in multiple Huawei devices, which stems from the product allowing unauthorized access to certain files. An attacker can exploit the vulnerability to potentially tamper with files...

CVE-2021-40116

Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device.The vulnerability is due to improper handling of the Block with Reset or Interactive Block with Reset action...

CVE-2021-40116

Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device.The vulnerability is due to improper handling of the Block with Reset or Interactive Block with Reset action...

CVE-2021-40116: Improper Handling of Unexpected Data Type

Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device.The vulnerability is due to improper handling of the Block with Reset or Interactive Block with Reset action...

Cisco Products Snort 安全漏洞

Cisco Products Snort is a Snort engine for Cisco Products from Cisco USA. A security vulnerability exists in Cisco Products Snort that results from improper handling of Block with Reset or Interactive Block with Reset operations when configuring rules without proper constraints. An attacker can...

CVE-2021-41035: Execution with Unnecessary Privileges

In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods...

CVE-2021-42169: Improper Neutralization of Special Elements used in an SQL Command

The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code by: oretnom23 is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account. The parameter username from the login form is not protected correctly and there is no security and escaping fr...

Beers with Talos, Ep. #110: The 10 most-exploited vulnerabilities this year (You won't believe No. 6!)

Beers with Talos BWT Podcast episode No. 110 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. We mainly spend this episode doing some catching up... This is only the...

CVE-2021-24736: Improper Neutralization of Input During Web Page Generation

The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues...

PT-2021-27856

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow WRITE 8 crash type. The crash state involves several function calls, including mrb funcall with block, mrb...

PT-2021-27858

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A heap-buffer-overflow WRITE 8 crash has been reported. The crash involves the following functions: mrb funcall with block, mrb funcall argv, and const ge...

PT-2021-27855

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow WRITE 8 crash type. The crash state involves several function calls, including mrb funcall with block and mr...

Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name

Impact preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name. Patches It was patched starting from 1.0.0-beta.59 Workarounds Do not run openapi-cli preview-docs command in the folder which contains files with...

CVE-2021-3436

BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. Zephyr versions = 1.14.2, = 2.4.0, = 2.5.0 contain Use of Multiple Resources with Duplicate Identifier CWE-694. For more information, see...

CVE-2021-41120

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to predict. The problem is that the Credit card form has...

CVE-2021-32762

Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis librar...

Internet safety tips for kids and teens: A comprehensive guide for the modern parent

When it comes to picking a new device for your child, its often difficult to know where to start. Whether youre looking for a smartphone, a laptop, a gaming device or something else, or even just signing up for an account online, you want to make sure your kids are protected. Its important to get...