CVE-2021-3852

growi is vulnerable to Authorization Bypass Through User-Controlled Key...

Mozilla: Browser window spoof using fullscreen mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When navigating from inside an iframe while requesting full screen access, an attacker-controlled tab could have made the browser unable to leave full screen mode...

CVE-2021-3852 Authorization Bypass Through User-Controlled Key in weseek/growi

growi is vulnerable to Authorization Bypass Through User-Controlled Key...

CVE-2021-3852

CVE-2021-3852 affects GROWI (WESEEK) and describes an authorization bypass through a user-controlled key. The connected sources specify an unauthenticated attacker could bypass authorization to delete arbitrary comments by abusing an endpoint such as /_api/comments.remove due to insufficient auth...

Jenkins Plugin 跨站请求伪造漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . A cross-site request forgery vulnerability exists in Jenkins Mailer that stems from the software's lack of validation f...

Weseek growi 安全漏洞

Weseek Growi is an open source wiki system that can be written in Markdown by the Japanese company Weseek. Weseek growi suffers from a security vulnerability that allows an attacker to bypass authorization with a user-controlled key...

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

Pipenv 命令注入漏洞

Pipenv is a tool designed to bring the best of all packaging worlds packager, composer, npm, cargo, yarn, etc. to the Python world. pipenv suffers from a command injection vulnerability that stems from allowing an attacker to insert specially crafted strings into comments anywhere in a...

Unbounded loop on array controlled by owner can lead to DoS

Handle robee Vulnerability details A malicious attacker that is also a protocol owner can push unlimitedly to an array, that some function loop over this array. If increasing the array size enough, calling the function that does a loop over the array will always revert since there is a gas limit...

Apache OFBiz Log4Shell Direct Check (CVE-2021-44228)

Binary data apacheofbizlog4shell.nbin...

vulhub

This is an open-source collection of vulnerable web applications and environments for security research and training. It is a repository of vulnerable systems, including web applications, databases, and other software, designed to help security professionals and researchers practice and improve...

U.S. Dept Of Defense: CUI Labelled document out in the open

Hi DoD VDP, I have found a document and each page of it is marked CUI : "Controlled Unclassified Information". According to your standards, this file shouldn't be publicly available on internet. This document was last edited on █████████ 2021. My investigation leads me to think it could have been...

SUSE SLED15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2021:4153-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:4153-1 advisory. - CVE-2021-28041: Fixed double free in ssh-agent bsc1183137. Tenable has extracted the preceding description block directly from the SUSE...

vulhub

This repository is an open-source collection of vulnerable systems and applications for educational purposes, specifically for learning and practicing penetration testing and vulnerability assessment. It is maintained by phith0n and hosted on GitHub. The repository contains various vulnerable...

Mattermost Input Validation Error Vulnerability (CNVD-2021-101986)

An input validation error vulnerability exists in Mattermost 6.0 and prior versions of Mattermost, an open source collaboration platform from Mattermost, Inc. The vulnerability stems from the program's failure to properly validate email addresses during registration. An attacker could exploit the...

TCMAN GIM Open Redirect Vulnerability

TCMAN Gim is facility management software designed for use on mobile devices.TCMAN GIM contains an open redirection vulnerability that could be exploited by an attacker to redirect users to an attacker-controlled page and obtain information...

CVE-2021-37862

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token...

CVE-2021-37862

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token...

Mattermost 代码问题漏洞

An input validation error vulnerability exists in Mattermost 6.0 and prior versions of Mattermost, an open source collaboration platform from Mattermost, Inc. The vulnerability stems from the program's failure to properly validate email addresses during registration. An attacker could exploit the...

CVE-2021-43675

Lychee-v3 3.2.16 is affected by a Cross Site Scripting XSS vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user...