CVE-2022-21721 DOS Vulnerability in next.js

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-...

UBUNTU-CVE-2022-21694

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure...

Mozilla: Browser window spoof using fullscreen mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When navigating from inside an iframe while requesting full screen access, an attacker-controlled tab could have made the browser unable to leave full screen mode...

Apple’s Private Relay Is Being Blocked

Some European cell phone carriers, and now T-Mobile, are blocking Apples Private Relay anonymous browsing feature. This could be an interesting battle to watch. Slashdot thread...

DRUPAL-CONTRIB-2022-001

This module enables you to login with an email address. The module doesn't sufficiently check if a user account is active when using email login. This vulnerability is mitigated by the fact that an attacker must have an account in the website that is blocked...

CVE-2021-31833

Potential product security bypass vulnerability in McAfee Application and Change Control MACC prior to version 8.3.4 allows a locally logged in attacker to circumvent the application solidification protection provided by MACC, permitting them to run applications that would usually be prevented by...

CVE-2021-45471

A flaw was found in mediawiki in versions through 1.37. Blocked IP addresses are allowed to edit EntitySchema items...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

Design/Logic Flaw

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

UBUNTU-CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

PT-2021-24243 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.38 Description: The issue allows blocked IP addresses to edit EntitySchema items. This is a problem in MediaWiki where blocked users can still make changes to certain items. Recommendations: For MediaWiki version...

Vulnerabilities fixed in Atlassian Jira Server

Atlassian has fixed two vulnerabilities in Jira Server. A authenticated malicious person could exploit the vulnerabilities to give themselves elevated privileges, gain access to sensitive data and manipulate that data. The vulnerability is in access control, which allows accounts that have been...

CVE-2021-22969

Concrete CMS formerly concrete5 versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS ex AWS IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading...

Locked Out of ‘God Mode,’ Runners Hack Their Treadmills

NordicTrack customers were watching Netflix using a simple trick—until the company blocked their access...

UBUNTU-CVE-2021-33816

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...

SuiteCRM 代码问题漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM Suitecrm team. A security vulnerability exists in SuiteCRM that stems from SuiteCRM prior to 7.11.19 that allows remote code execution to be set via the system settings log file name. An attacker can exploit the vulnerability...

CVE-2021-41801

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time due to the job queue backlog...

DEBIAN-CVE-2021-41801

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time due to the job queue backlog...

CVE-2021-41801

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time due to the job queue backlog...