CVE-2021-38325

The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...

CVE-2021-38325 User Activation Email <= 1.3.0 Reflected Cross-Site Scripting

The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...

CVE-2021-38325

CVE-2021-38325 affects the WordPress plugin User Activation Email (versions

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin User Activation Email 1.3 and earlier versions, whic...

CVE-2021-30729

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results...

CVE-2021-30729

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results...

CVE-2021-30729

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results...

Code injection

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results...

CVE-2021-30729

CVE-2021-30729 affects Apple iOS/iPadOS 14.x components (notably CommCenter). A logic issue could allow a device to accept invalid activation results. The issue is fixed in iOS 14.6 / iPadOS 14.6. Remediation: update to iOS/iPadOS 14.6 or later. Exploitation details are not provided in the connec...

CVE-2021-30729

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results...

PT-2021-18833 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.6 iPadOS versions prior to 14.6 Description: A logic issue was addressed with improved restrictions. The issue allowed a device to accept invalid activation results. Recommendations: For iOS versions prior to 14.6,...

User Activation Email <= 1.3.0 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts...

Cross-Site Request Forgery (CSRF) in imran300/inventory

✍️ Description You didn't set any CSRF protection for activating a user. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' document.forms0.submit; After that admin open the PoC.html file the user with id 7 will be activated. 💥 Impact This vulnerability is capable of activate any user...

August 26, 2021—KB5005103 (OS Build 18363.1766) Preview

None None...

August 26, 2021—KB5005102 (OS Build 17763.2145) Preview

None None...

BuddyPress < 9.1.1 - Activation Key Disclosure

The plugin disclosed the activation key from responses of the createitem method in the BP REST API Signup controller...

G2A's Journey to Global Growth, Part 1: Keeping Gamers and Geeks Playing During a Pandemic

Near the end of March 2020, G2A.COM saw its traffic virtually double overnight. The pandemic had just begun, and people were looking for ways to stay entertained and connected under lockdown. Not surprisingly, a lot of people turned to video games, and G2A.COM was one of the first places they wen...

Leawo Prof. Media 11.0.0.1 Denial Of Service

Exploit Title: Leawo Prof. Media 11.0.0.1 - Denial of Service DoS PoC Date: 25.07.2021 Vendor Homepage:https://www.leawo.org Software Link: https://www.leawo.org/downloads/total-media-converter-ultimate.html Exploit Author: Achilles Tested Version: 11.0.0.1 Tested on: Windows 7 x64 1.- Run python...

Simple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitize user input when an authenticated user Text value, then it does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. 1. Install WordPress 5.7.2 2. Install and activate Simple Post 3. Navigate to...

RLSA-2021:2717 Important: systemd security update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes...