WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

UBUNTU-CVE-2021-3731

LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions...

CVE-2021-20498

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972...

ZOLL Defibrillator Dashboard Cross-Site Scripting Vulnerability

ZOLL Defibrillator Dashboard is a defibrillator management tool. A cross-site scripting vulnerability exists in versions of ZOLL Defibrillator Dashboard prior to 2.2. An attacker can exploit this vulnerability to inject and execute malicious scripts...

CVE-2020-10771

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery CSRF attack...

CVE-2021-20529

IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 198763...

Facebook WhatsApp 缓冲区错误漏洞

Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...

CloudBees Jenkins REST List Parameter Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

PT-2021-10347 · Emerson · Emerson Smart Wireless Gateway 1420

Name of the Vulnerable Software and Affected Versions: Emerson Smart Wireless Gateway 1420 version 4.6.59 Description: The issue allows remote attackers to obtain sensitive device information from the administrator console without authentication. This is due to incorrect access control...

CVE-2020-4673

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

CVE-2020-4674

IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287...

Stable Yield Credit Security Breach

Stable Yield Credit is a new protocol for decentralized lending, stablecoin, and automated market maker AMM in one for the Stable Yield Credit community. Stable Yield Credit suffers from a security vulnerability that stems from certain miscalculations in the deposit function. An attacker could...

Authorization

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

PT-2020-15476 · Jenkins · Jenkins Mailer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions 1.32 and earlier Description: The issue is related to the lack of hostname validation when connecting to the configured SMTP server. This could be exploited using a man-in-the-middle attack to intercept...

SAP NetWeaver AS ABAP Cross-Site Scripting Vulnerability

SAP Netweaver is an integrated, service-oriented application platform. ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP, which can be exploited by remote attackers to...

FILM NUMBER ERROR VULNERABILITY

FILM is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in the smart contract implementation of FILM. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

MyYLC Numeric Error Vulnerability

MyYLC is an ethereum-based digital currency. An input validation error vulnerability exists in the 'mintToken' function in MyYLC's smart contract implementation. An attacker could use this vulnerability to set the balance of any user to an arbitrary value...

CVE-2020-11957

The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number Pairing Random with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with...

USN-4365-1 bind9 vulnerabilities

Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Bind incorrectly limited certain fetches. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service, or possibly use Bind to perform a reflection attack. CVE-2020-8616 Tobias...

python: Cookie domain check returns incorrect results

http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostnam...