CVE-2021-35220

SolarWinds Orion Platform 2020.2.0 before 2020.2.6 HF1 is affected by CVE-2021-35220 (EmailWebPage API command injection). An authenticated remote attacker could exploit this via the Alerts Settings page to achieve Remote Code Execution. Remediation: upgrade to 2020.2.6 HF1 or later; apply vendor...

CVE-2021-35219 ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page...

CVE-2021-35219

SolarWinds Orion Platform prior to 2020.2.6 HF1 is affected by CVE-2021-35219: ExportToPdfCmd Arbitrary File Read via the ImportAlert function in the Alerts Settings page. The vulnerability allows an authenticated, remote attacker to read arbitrary files. Remediation is to upgrade to 2020.2.6 HF1...

PT-2021-20846 · Solarwinds · Oroplatform

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to an Improper Access Control Tampering Vulnerability using the ImportAlert function, which can lead to a Remote Code Execution RCE...

CVE-2021-34642

The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10...

Cross site scripting

The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10...

CVE-2021-34642

The CVE-2021-34642 entry concerns the WordPress Smart Email Alerts plugin (versions up to 1.0.10) vulnerable to Reflected Cross-Site Scripting via the api_key in ~/views/settings.php. The underlying issue allows injection of arbitrary scripts, with network access and user interaction required (CV...

CVE-2021-34642 Smart Email Alerts <= 1.0.10 Reflected Cross-Site Scripting

The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10...

CVE-2021-34642 Smart Email Alerts <= 1.0.10 Reflected Cross-Site Scripting

The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin. WordPress Smart Email Alerts plug-in has a cross-site...

WordPress 插件授权问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. An authorization issue vulnerability exists i...

WordPress Smart Email Alerts plugin <= 1.0.10 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Smart Email Alerts plugin versions = 1.0.10. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...

Smart Email Alerts <= 1.0.10 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts...

CVE-2021-36936

creationtimestamp| type| source ---|---|--- 2021-08-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=628 2021-08-11 18:46:50+00:00| seen| https://t.me/truesecator/1993 2026-09-01 20:02:28+00:00| seen| https://t.me/hackingAttack/19795 2026-09-01 20:02:28+00:00| seen|...

OPENSUSE-SU-2021:1051-1 Security update for fossil

This update for fossil fixes the following issues: fossil 2.16: Add the fossil patch command Improve the fossil ui command to work on check-out directories and remote machines web UI improvements Add fossil bisect run command for improved automation of bisects Improve fossil merge handling of...

OPENSUSE-SU-2021:1050-1 Security update for fossil

This update for fossil fixes the following issues: fossil 2.16: Add the fossil patch command Improve the fossil ui command to work on check-out directories and remote machines web UI improvements Add fossil bisect run command for improved automation of bisects Improve fossil merge handling of...

Instagram Launches 'Security Checkup' to Help Users Recover Hacked Accounts

Instagram earlier this week introduced a new "Security Checkup" feature that aims to keep accounts safe and help users—whose accounts may have been compromised—to recover them. In order to gain access to accounts, users will be prompted to perform a series of steps, which include checking recent...

Security update for fossil (moderate)

openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2021:1052-1 Rating: moderate References: 1187988 Affected Products: openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be installed. Description: This update for fossil fixes the following...

New StopRansomware.gov website – The U.S. Government’s One-Stop Location to Stop Ransomware

The U.S. Government launched a new website to help public and private organizations defend against the rise in ransomware cases. StopRansomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts. We encourage organizations to use this new...

CVE-2020-35984

A stored cross site scripting XSS vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter...