6256 matches found
CVE-2021-40087
An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log that can only be viewed by an administrator. This affects us...
CVE-2021-40087
PrimeKey EJBCA before version 7.6.0 is affected by an issue where modifications to enrollment-secret alias configurations for protocols SCEP, CMP, and EST are logged in cleartext in the audit log (administrator-accessible). The vulnerability arises from audit logging changes to alias configuratio...
PT-2021-22797 · Primekey · Primekey Ejbca
Name of the Vulnerable Software and Affected Versions: PrimeKey EJBCA versions prior to 7.6.0 Description: An issue was discovered where modifications to enrollment secrets in the alias configurations of certain protocols were logged in cleartext in the audit log. This affects the use of protocol...
Primekey Solutions PrimeKey EJBCA 安全漏洞
Primekey Solutions PrimeKey EJBCA is a full-featured CA system software from PrimeKey Solutions Primekey Solutions, Sweden. The software is used for domain certificate management, enrollment and enrollment-to-certificate validation and other functions to achieve access security. A security...
AuraBorealisApp - Do You Know What's In Your Python Packages? A Tool For Visualizing Python Package Registry Security Audit Data
AuraBorealis is a web application for visualizing anomalous and potentially malicious code in Python package registries. It uses security audit data produced by scanning the Python Package Index PyPI via Aura, a static analysis designed for large scale security auditing of Python packages. The...
CVE-2021-24445
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...
Cross site scripting
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...
CVE-2021-24445
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...
CVE-2021-24445
CVE-2021-24445 affects the WordPress My Site Audit plugin up to version 1.2.4. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) caused by failure to sanitize/escape the Audit Name field when creating audits, allowing a high-privilege user to inject JavaScript payloads even ...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
Hacker Steals $610M of Cryptocurrency—and Returns Most of It
Plus: An Apple lawsuit, a VPN audit, and more of the week's top security news...
IBM Security Guardium Information Disclosure Vulnerability (CNVD-2021-65731)
IBM Security Guardium is a suite of platforms from IBM USA that provides data protection capabilities. The platform includes features such as customizable UI, report management and streamlined audit process building. IBM Security Guardium has a security vulnerability that stems from the use of...
IBM Security Guardium 安全漏洞
IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as customizable UI, report management and streamlined audit process building. IBM Security Guardium suffers from a security vulnerability that...
CVE-2021-33256
A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...
Design/Logic Flaw
DISPUTED A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts...
PT-2021-20095 · Manageengine · Zoho Manageengine Adselfservice Plus
Name of the Vulnerable Software and Affected Versions: ManageEngine ADSelfService Plus version 6.1 Build No: 6101 Description: A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus can be exploited by an unauthenticated user. The j username parameter seems to be...
Weak Password Vulnerability in Black Shield Network Security Audit System
Fujian Strait Information Technology Co., Ltd. is a state-controlled high-tech enterprises, specializing in network security technology field of technical research, product sales, information security services and other businesses. A weak password vulnerability exists in the Black Shield Network...
Auditors: Feds’ Cybersecurity Gets the Dunce Cap
Out of eight U.S. federal agencies identified two years ago with critical cybersecurity failures, seven still don’t meet basic standards, a new audit report found. The Federal government’s overall posture was given just a C-. Audited agencies included the Departments of State, Homeland Security,...