PT-2024-22357

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed version Description The issue allows an attacker to discover the existence of secret categories when they have backgrounds set. This is a problem in an open source platform f...

[SECURITY] Fedora 40 Update: CardManager-3-29.fc40

This is free, open source multiplatform java application which allows you to play ANY card game. The game is designed especially to play collectible card games like Magic the Gathering or Doomtrooper over network. To play those games you need to own scanned images of card, which are not p art of...

CVE-2021-4419

The CVE-2021-4419 entry describes a Cross-Site Request Forgery in the WordPress plugin WP-Backgrounds Lite (versions up to 2.3). The vulnerability arises from missing or incorrect nonce validation in the ino_save_data() function, enabling unauthenticated attackers to save metadata via forged requ...

CVE-2021-4419: Cross-Site Request Forgery (CSRF)

The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the inosavedata function. This makes it possible for unauthenticated attackers to save meta data via a forged...

PT-2023-12531

Name of the Vulnerable Software and Affected Versions WP-Backgrounds Lite plugin for WordPress versions up to and including 2.3 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ino save data function. This allows unauthenticated...

WordPress Plugin WP-Backgrounds Lite has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

new packages: gnome-backgrounds

An update is available for gnome-backgrounds. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Defenders wanted—building the new cybersecurity professionals

As part of Cybersecurity Awareness Month, we published a special blog post earlier this week featuring real-world experiences shared by cybersecurity professionals: people with diverse backgrounds in law, academia, software development, and other seemingly unrelated fields. This topic is near and...

CVE-2021-33178

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

DEBIAN-CVE-2021-33178

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

Path traversal

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

UBUNTU-CVE-2021-33178

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

CVE-2021-33178

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

CVE-2021-33178

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

CVE-2021-33178

CVE-2021-33178 affects NagVis (Manage Backgrounds) prior to 1.9.29. An authenticated path traversal allows a malicious actor to arbitrarily delete files on the local system. Debian LTS advisory DLA-4149-1 indicates the fix for Debian 11 is in nagvis 1:1.9.25-2+deb11u1. Other linked advisories cor...

CVE-2021-33178

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

CVE-2021-33178

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

CVE-2021-33178: Improper Limitation of a Pathname to a Restricted Directory

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system...

WordPress WP-Backgrounds Lite plugin <= 2.3 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress WP-Backgrounds Lite plugin versions = 2.3. Solution This plugin has been closed as of June 15, 2021 and is not available for download. Reason: Security Issue...

CVE-2021-3619

Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting XSS issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to...