3810 matches found
CVE-2021-24745
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks...
CVE-2021-24745
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks...
CVE-2021-24745
CVE-2021-24745 affects the WordPress plugin About Author Box (versions before 1.0.2). The root cause is failure to sanitize and escape values in the Social Profiles field before rendering in attributes, enabling a stored cross-site scripting (XSS) flaw. The issue permits a user with a low-privile...
CVE-2021-24745 About Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in versions of Th...
CentOS 7 : firefox (RHSA-2021:4116)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4116 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or...
CentOS 7 : thunderbird (RHSA-2021:4134)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4134 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or...
Costco Confirms: A Data Skimmer’s Been Ripping Off Customers
Costco has discovered a payment card skimming device at one of its retail stores and has sent out notification letters informing customers that their card data may have been ripped off if they shopped there recently. Some customers have been aware for weeks that something was fishy and have been...
FormatFuzzer - A Framework For High-Efficiency, High-Quality Generation And Parsing Of Binary Inputs
FormatFuzzer is a framework for high-efficiency, high-quality generation and parsing of binary inputs. It takes a binary template that describes the format of a binary input and generates an executable that produces and parses the given binary format. From a binary template for GIF, for instance,...
CVE-2021-41426
Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery CSRF via mgtenduser.htm...
CVE-2021-41426
Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery CSRF via mgtenduser.htm...
CVE-2021-41427
Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting XSS via the choosemac parameter to setup.cgi...
CVE-2021-41427
Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting XSS via the choosemac parameter to setup.cgi...
CVE-2021-41426
Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery CSRF via mgtenduser.htm...
Cross site scripting
Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting XSS via the choosemac parameter to setup.cgi...
Cross site request forgery (csrf)
Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery CSRF via mgtenduser.htm...
CVE-2021-41426
CVE-2021-41426 affects Beeline Smart Box 2.0.38, with a CSRF vulnerability exposed via the mgt_end_user.htm page. The CVE entry is supported by multiple sources (NVD, Red Hat, CVE List, etc.). The issue is described as vulnerable to CSRF, but the connected documents do not provide explicit exploi...
CVE-2021-41426
Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery CSRF via mgtenduser.htm...
CVE-2021-41427
Beeline Smart Box 2.0.38 is vulnerable to a Cross Site Scripting (XSS) flaw in the setup.cgi endpoint, exploitable via the choose_mac parameter. The issue is documented under CVE-2021-41427. Affected component: the web interface handling setup.cgi; vulnerability type: XSS. Impact details in the p...