3604 matches found
Minor update for Vivaldi Desktop Browser 5.1
Download Vivaldi The following improvements were made since the initial 5.1 stable release: Chromium Upgraded to 98.0.4758.105 includes fix for CVE-2022-0609 CrashWindows Playing videos VB-86275 Mail Beta Account root folder shows all messages for all accounts VB-86337 Mail Beta Clicking Other...
D-Link DIR-X1860 跨站脚本漏洞
The D-Link Dir-X1860 is a dual-band router from D-Link China.A security vulnerability exists in the D-Link DIR-X1860, which stems from a reflected cross-site scripting attack in the D-Link DIR-X1860 web application prior to v1.10WWB09 Beta, which can be exploited by an attacker to sending a...
CVE-2021-41441
A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09Beta allows a remote unauthenticated attacker to reboot the router via sending a specially crafted URL to an authenticated victim. The authenticated victim need to visit this URL, for the router to reboot...
Strapi CMS Unauthenticated Password Reset
This module abuses the mishandling of a password reset request for Strapi CMS version 3.0.0-beta.17.4 to change the password of the admin user. Successfully tested against Strapi CMS version 3.0.0-beta.17.4. Module Options msf use auxiliary/scanner/http/strapi/3passwordreset msf...
Strapi CMS 3.0.0-beta.17.4 Privilege Escalation
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Strapi CMS 3.0.0-beta.17.4 - Set Password Unauthenticated Metasploit", 'Description' = %q This exploit module abuses the...
CVE-2020-23315: Undefined Security Weakness
There is an ASSERTION pFuncBody-GetYieldRegister == oldYieldRegister failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beta...
How Apple's iCloud Private Relay Can Keep You Safe
The newest security measure is still in beta. But if you want to make use of it, here's what you need to know...
Design/Logic Flaw
Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the tests-passed branch, version 2.8.0.beta11 in the beta branch, and version 2.7.13 in the stable branch, the bios of users who made their profiles private were still visible in the tags on their users' pages. The...
PT-2022-15035 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.13 Discourse version 2.8.0.beta11 in beta and tests-passed Description: The issue allows some users to log in to a community before they should be able to do so. A user invited via email to a forum with must...
Signal's Cryptocurrency Feature Has Gone Worldwide
A beta “payments” feature now lets users of the popular encrypted messaging app send MobileCoin around the globe...
Adobe: Log4j Java RCE in [beta.dev.adobeconnect.com]
Hello Security Team, Summary Log4j versions prior to 2.15.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per Apache's Log4j security guide: Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker...
CVE-2022-21642
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...
Design/Logic Flaw
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...
Design/Logic Flaw
containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface CRI, an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any...
CVE-2022-21642 Exposure of whisper participants in discourse
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...
PT-2022-14998 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.13 Discourse versions prior to 2.8.0.beta11 Description: Discourse is an open source platform for community discussion. In affected versions, when composing a message from a topic, the composer user suggestions...
Cross site scripting
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...
Cross site scripting
MetInfo 7.0 beta contains a stored cross-site scripting XSS vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn...
CVE-2020-20600
CVE-2020-20600 affects MetInfo 7.0 beta. The vulnerability is a stored cross-site scripting (XSS) in the $name parameter of admin/?n=column&c=index&a=doAddColumn. This is confirmed across multiple feeds (NVD, RH, CVE lists) and is tied to MetInfo 7.0 beta with the vulnerability location in the sp...
