CVE-2021-29256

creationtimestamp| type| source ---|---|--- 2021-05-25 03:01:58+00:00| published-proof-of-concept| Telegram/jhwyL11yVmFESpcelIBi7PAHZPodVkOAezDp-1y2seYC-7o 2023-07-07 12:20:04+00:00| exploited| https://t.me/truesecator/4590 2023-07-07 18:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e012...

libgrss 信任管理问题漏洞

libgrss is a Glib library for handling RSS, Atom and other formats of feeds. A security vulnerability exists in libgrss version 0.7.0, which stems from libgrss' inability to perform TLS certificate validation when downloading a feed, and can be exploited by remote attackers to manipulate the...

WordPress 10Web Social Photo Feed plugin <= 1.4.18 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze and Thura Moe Myint in WordPress 10Web Social Photo Feed plugin versions = 1.4.18. Solution Update the WordPress 10Web Social Photo Feed plugin to the latest available version at least 1.4.19...

python-urllib3: CRLF injection via HTTP request method

A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrit...

python: CRLF injection via HTTP request method in httplib/http.client

A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat fr...

PT-2021-24340 · Hewlett Packard · Hpe Integrated Lights-Out 5 +1

Name of the Vulnerable Software and Affected Versions: Hewlett Packard Enterprise Integrated Lights-Out 5 affected versions not specified Description: A Cross Site Scripting XSS issue has been identified, along with other potential security vulnerabilities such as CR-LF injection, DOM XSS, and...

CVE-2021-31166

creationtimestamp| type| source ---|---|--- 2021-05-12 13:59:45+00:00| seen| https://t.me/thehackernews/1212 2021-05-15 14:00:18+00:00| seen| https://t.me/HackerOne/3005 2021-05-17 06:35:10+00:00| published-proof-of-concept| https://t.me/cKure/5378 2021-05-17 12:23:36+00:00|...

Brave Software: XSS on Brave Today through custom RSS feed

A vulnerability was discovered in Brave iOS's custom RSS feed feature that allowed for cross-site scripting XSS attacks. Attackers could add a malicious RSS feed containing a javascript: URL, which could execute arbitrary code when a user clicked on a link in Brave Today. The vulnerability was...

CVE-2021-31164

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements...

CVE-2021-30665

creationtimestamp| type| source ---|---|--- 2021-05-04 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=579 2021-05-04 08:13:01+00:00| seen| https://t.me/cKure/5148 2021-05-04 11:05:48+00:00| exploited| https://t.me/truesecator/1671 2021-05-25 12:03:30+00:00| exploited|...

CVE-2021-30666

creationtimestamp| type| source ---|---|--- 2021-05-04 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=579 2021-05-04 08:13:01+00:00| seen| https://t.me/cKure/5148 2021-09-08 18:42:44+00:00| exploited| https://t.me/cibsecurity/28487 2021-11-08 08:58:17+00:00| seen|...

PT-2021-12976 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 18.1R3-S11 Juniper Networks Junos OS versions prior to 18.2R3-S5 Juniper Networks Junos OS versions prior to 18.3R2-S4, 18.3R3-S3 Juniper Networks Junos OS versions prior to 18.4R2-S5, 18.4R3-S3...

CVE-2021-3493

creationtimestamp| type| source ---|---|--- 2021-04-21 10:26:15+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/222 2021-04-26 11:02:21+00:00| seen| https://t.me/CyberSecurityTechnologies/3219 2021-05-08 12:54:09+00:00| published-proof-of-concept|...

CVE-2021-20021

creationtimestamp| type| source ---|---|--- 2021-04-21 01:32:05+00:00| seen| https://t.me/cKure/4953 2021-04-21 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=572 2021-04-22 15:55:13+00:00| exploited| https://t.me/NeKaspersky/777 2021-11-08 08:58:19+00:00| seen|...

CVE-2021-20023

creationtimestamp| type| source ---|---|--- 2021-04-21 01:32:05+00:00| seen| https://t.me/cKure/4953 2021-04-21 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=572 2021-04-22 15:55:13+00:00| exploited| https://t.me/NeKaspersky/777 2021-11-08 08:58:19+00:00| seen|...

PT-2022-2220

Name of the Vulnerable Software and Affected Versions Python versions prior to 3.10.0b1 Python versions prior to 3.9.5 Python versions prior to 3.8.11 Python versions prior to 3.7.11 Python versions prior to 3.6.14 Description The issue involves the urllib.parse module in Python, which does not...

CVE-2021-21220

creationtimestamp| type| source ---|---|--- 2021-04-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=568 2021-04-15 13:59:21+00:00| published-proof-of-concept| https://t.me/NeKaspersky/737 2021-04-16 11:01:26+00:00| published-proof-of-concept|...

CVE-2021-28310

creationtimestamp| type| source ---|---|--- 2021-04-13 19:42:23+00:00| exploited| https://t.me/ctinow/31796 2021-04-13 19:42:24+00:00| exploited| https://t.me/ctinow/31797 2021-04-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=567 2021-04-14 04:19:35+00:00| exploited|...

CVE-2021-33766

creationtimestamp| type| source ---|---|--- 2021-04-13 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2021/04/april-2021-update-tuesday-packages-now-available/ 2021-08-30 20:48:52+00:00| seen| https://t.me/cibsecurity/28015 2021-08-30 21:16:05+00:00| seen| https://t.me/cKure/6874 2021-08-3...

Price feed can be manipulated

Vulnerability details Anyone can trigger an update to the price feed by calling PriceAware.getCurrentPriceInPegtoken, inAmount, forceCurBlock=true. If the update window has passed, the price will be computed by simulating a Uniswap-like trade with the amounts. This simulation uses the reserves of...