5084 matches found
CVE-2021-24420
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table...
CVE-2021-24440
The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in...
CVE-2021-24420
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table...
WordPress 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. cross-site scripting vulnerability exists in versio...
IBM Cloud Pak for Applications 跨站脚本漏洞
IBM Cloud Pak for Applications is an application from IBM America, Inc. It provides a cloud-native development solution that delivers value quickly. A cross-site scripting vulnerability exists in IBM Cloud Pak for Applications, which stems from the product's lack of effective validation of...
Weak Password Vulnerability in Bohua NetDragon Information Security All-in-One Computer
Ltd. is a high-tech enterprise mainly engaged in software product development, information security product development, and computer system integration and information security services as a whole. A weak password vulnerability exists in Bohua NetDragon Information Security All-in-One Computer,...
Qualcomm 芯片缓冲区错误漏洞
The Qualcomm MDM9206 and APQ8053 are both central processing unit CPU products from Qualcomm Incorporated. A buffer error vulnerability exists in the Qualcomm APQ8009, which stems from a lack of boundary check validation when loading a splash image in the device's Boot subsystem. An attacker with...
CVE-2021-23402
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-20752
Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...
PT-2021-12045 · Unknown · Uwebsockets
Name of the Vulnerable Software and Affected Versions: uWebSockets versions 18.11.0 through 18.12.0 Description: The issue is related to a stack-based buffer overflow in the uWS::TopicTree::trimTree function, which is called from uWS::TopicTree::unsubscribeAll. The vendor disputes the severity of...
JVN#65660590: boastMachine vulnerable to cross-site scripting
boastMachine provided by knadh contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Stop using "boastMachine" The developer states that the product is no longer supported, therefore stop using the product. Products...
Arbitrary File Read Vulnerability in MyCnCart of Qingdao All-in-One Network Technology Co.
MyCnCart MCC for short is a free, open source B2C, B2B e-commerce platform system developed for the Chinese mainland market. MyCnCart has an arbitrary file read vulnerability that can be exploited by attackers to obtain sensitive information...
WordPress All in One SEO Pack Plugin < 4.1.0.2 RCE Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aioseo:allinoneseo"; if description...
PT-2021-19246
Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels affected versions not specified SINAMICS SL150: All versions SINAMICS SM150: All versions SINAMICS SM150i: All versions Description The issue concerns the Telnet service of the SIMATIC HMI Comfort Panels system...
Encouraging women to embrace their cybersecurity superpowers
The cybersecurity challenges of today require a diversity of skills, perspectives, and experiences, yet women remain underrepresented in this field. On International Women’s Day, some Microsoft Security women leaders penned a powerful blog highlighting the underrepresentation of women in...
UVI-2021-1000760 x86/kvm: Disable all PV features on crash
x86/kvm: Disable all PV features on crash This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.125 by commit...
GHSA-M6CP-VXJX-65J6 SessionListener can prevent a session from being invalidated breaking logout
Impact If an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application us...
CVE-2021-0521
In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of cross-user permissions with no additional execution privileges needed. User interaction is not needed for...
CVE-2021-0521
In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of cross-user permissions with no additional execution privileges needed. User interaction is not needed for...