1901 matches found
CVE-2021-24317
The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues...
CVE-2021-24317
The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues...
CVE-2020-26559
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device participating in the provisioning protocol to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could...
CVE-2020-26559
CVE-2020-26559 (Bluetooth Mesh Provisioning) affects Bluetooth Mesh provisioning (Mesh profile 1.0/1.0.1). A nearby attacker participating in the provisioning protocol can identify the AuthValue and the provisioning device’s confirmation number and nonce, potentially enabling provisioning complet...
Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities
The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...
Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities
The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...
CVE-2021-31897
CVE-2021-31897 affects JetBrains WebStorm prior to 2021.1, where code execution without user confirmation was possible for untrusted projects. The vulnerability is documented across multiple sources (NVD entry and Red Hat advisory) and is addressed in WebStorm 2021.1 per JetBrains’ Q1 2021 Securi...
DEBIAN-CVE-2021-32563
An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the file type without user confirmation. This could be used to achieve code execution...
Denial Of Service (DoS)
matrix-synapse is vulnerable to denial of service. The vulnerability exists due to missing input validation of some parameters on the endpoints used to confirm third-party identifiers...
Cross-site scripting (XSS) vulnerability in the password reset endpoint
Impact The password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources...
HackerOne: Used email confirmation link reveals the email address which is tied to it
Summary: If an attacker finds an used email confirmation link the token is in URL s/he will be able to see the email address which is tied to the confirmation link ID. The attack itself is pretty unlikely but the application should show the generic error message like The confirmation ID is invali...
Acronis: Account Confirmation bypass leads to acess some fucntionality
STEPS: 1. Go to the URL https://account.acronis.com//auth/signup 2. Create a Business Account 3. Intercept the request using burp suite 4. Now intercept the response of given HTTP REQUEST below 5. Change the field "confirmed":false to true 6. Even you can bypass Accept term condition by changing...
CVE-2021-27931
creationtimestamp| type| source ---|---|--- 2021-03-03 22:45:43+00:00| seen| https://t.me/cibsecurity/24429 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-27931.yaml 2025-01-26 00:00:00+00:00| seen| The Shadowserver...
Release information for Veeam Service Provider Console v5
A newer version of Veeam Service Provider Console is available, review Veeam for service providers: Download for more information. Requirements Please confirm that you are running version 4 build 4.0.0.4877 or later prior to upgrading. You can check this under Configuration | Support Information ...
PT-2021-17521 · Mitre · Mitreid Connect
Name of the Vulnerable Software and Affected Versions: MITREid Connect versions through 1.3.3 Description: The OpenID Connect server implementation for MITREid Connect contains a Mass Assignment vulnerability, also known as Autobinding. This issue arises due to the unsafe usage of the...
CS Money: Html injection on subscription email
Vulnerability description not provided...
CVE-2021-25323
The default setting of MISP 2.4.136 did not enable the requirements aka requirepasswordconfirmation to provide the previous password when changing a password...
CVE-2021-0306
In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITYRECOGNITION permission without user confirmation. This could lead to local escalation of privilege with no...
Engel & Völkers Technology GmbH: Blind SSRF on infodesk.engelvoelkers.com via proxy.php
Summary: The application has a proxy.php file which basically accepts a parameter via url query parameter and passes it to fopen. However, it doesn't validate the parameter value prior to passing it to fopen- making it possible to influence what's being done. That said, because of code following...
Automattic: [sub.wordpress.com] - XSS when adjust block Poll - Confirmation Message - On submission:Redirect to another webpage - Redirect address:[xss_payload]
Summary: Dear Wordpress Team, Today when I tried to create a post with block "Poll" and I have found at Poll Block - Confirmation Message - On submission:Redirect to another webpage and Redirect address:xsspayload At Redirect address line, I can save the javascript:alertdocument.cookie as an URL...