SUSE: Security Advisory (SUSE-SU-2018:2928-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-30479

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...

nodejs-immer: prototype pollution may lead to DoS or remote code execution

This affects all versions of package immer...

datatables.net: prototype pollution if 'constructor' were used in a data property name

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806...

datatables.net: prototype pollution if 'constructor' were used in a data property name

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806...

PT-2021-18750

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 3.4 Description An issue was discovered in the implementation of the all public streams API feature, resulting in guest users being able to receive message traffic to public streams that should have been only...

GHSA-7H8X-WMQ2-7MFF Command injection in launchpad

All versions of package launchpad are vulnerable to Command Injection via stop...

mongo-express 代码问题漏洞

mongo-express is a lightweight, web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in all versions of mongo-express that stems from an unhandled exception...

GHSA-VH8F-XW5V-8993 Command Injection in macfromip

All versions of npm package macfromip are affected by a command injection vulnerability. The injection point is located in line 66 in macfromip.js...

PT-2021-15744

Name of the Vulnerable Software and Affected Versions: wpDataTables – Tables & Table Charts premium WordPress plugin versions prior to 3.4.2 Description: The issue allows a low-privilege authenticated user to perform Boolean-based blind SQL Injection on the "/wp-admin/admin-ajax.php?action=get...

CVE-2021-24152

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

CVE-2021-24152

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

CVE-2021-24152

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

CVE-2021-24152

Popup Builder (WordPress plugin) is affected by CVE-2021-24152, a reflected XSS in the All Subscribers setting page. The vulnerability affects versions prior to 3.74, and requires an authenticated attacker to entice a logged-in user to a crafted URL to execute arbitrary scripts in the user’s brow...

PT-2021-15697

Name of the Vulnerable Software and Affected Versions: Popup Builder affected versions not specified Description: The issue concerns a reflected Cross-Site Scripting vulnerability in the "All Subscribers" setting page of Popup Builder. Recommendations: At the moment, there is no information about...

CVE-2021-24152: Improper Neutralization of Input During Web Page Generation

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

PT-2021-18176

Name of the Vulnerable Software and Affected Versions: Mahara version 20.10 Description: The issue allows a remote attacker to remove inbox-mail on the server due to a Cross Site Request Forgery CSRF vulnerability. The application fails to validate the CSRF token for a POST request. An attacker c...

CVE-2020-6785

Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This...

PT-2021-12597

Name of the Vulnerable Software and Affected Versions: Bosch BVMS versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older Bosch BVMS Viewer versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older Bosch DIVAR IP 7000 R2 with BVMS versions prior to 10.1.1 Bosch DIVAR IP all-in-one 5000 with BVMS versions...

CVE-2020-6785: Uncontrolled Search Path Element

Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This...