WordPress plugin LearnPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin LearnPress, which stems from insufficient...

@backstage/plugin-scaffolder-backend-module-cookiecutter (0.1.0), @backstage/plugin-scaffolder-backend-module-rails (>=0.1.1, <=0.1.3) potentially affected by CVE-2021-41151 via @backstage/plugin-scaffolder-backend (>=0.12.4, <=0.14.2)

@backstage/plugin-scaffolder-backend NPM version =0.12.4, =0.1.1, =0.1.3 Source cves: CVE-2021-41151 Source advisory: OSV:GHSA-PVV8-8FX9-H673...

[SECURITY] Fedora 34 Update: moby-engine-20.10.9-1.fc34

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between - and they don'...

CVE-2021-41151

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

CVE-2021-41151

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

CVE-2021-40842

Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the...

Sql injection

Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the...

Guide: How to Hack API in 60 minutes or API Threats Simulation with Open-Source Tools

What is API? API is the abbreviation for Application Programming Interface, which is a product middle person that permits two applications to converse with one another. Useful link: Api security tutorial for beginners and professionals What Is API Testing: Benefits, Types, How To Start ‍OpenAPI...

Authorization

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...

GHSA-6GJF-7W99-J7X7 Deleted Admin Can Sign In to Admin Interface

Impact Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0. Patches The issue has been patched in v2.1.12 Workarounds - Reset the password of the deleted accounts to prevent them from signing in. - Plea...

October CMS 授权问题漏洞

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. October CMS suffers from an authorization issue vulnerability where a previously deleted administrator account may still be able to log into the backend using October CMS v2.0...

Cross-Site-Request-Forgery in Backend

Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 8.2 Problem It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as described i...

GHSA-657M-V5VM-F6RW Cross-Site-Request-Forgery in Backend

Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 8.2 Problem It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as described i...

CVE-2021-41113 Cross-Site-Request-Forgery in Backend URI Handling in Typo3

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. The impact is the same as...

CVE-2021-41286

Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity of the password is checked locally. All communication to the database backend is made via the same technical account. Consequently, an attacker can attach a...

CVE-2021-41286

Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity of the password is checked locally. All communication to the database backend is made via the same technical account. Consequently, an attacker can attach a...

TYPO3-CORE-SA-2021-014: Cross-Site-Request-Forgery in Backend URI Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2021-014...

TYPO3-CORE-SA-2021-014: Cross-Site-Request-Forgery in Backend URI Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2021-014...

Cross-Site-Request-Forgery in Backend URI Handling

It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery...

TYPO3 跨站请求伪造漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. URL redirect is a URL redirection extension plugin used in it. TYPO3 is vulnerable to cross-site request forgery, which stems from a software feature that allows users to create and share...