5103 matches found
PT-2021-15688 · WordPress · 301 Redirects - Easy Redirect Manager
Name of the Vulnerable Software and Affected Versions: 301 Redirects - Easy Redirect Manager WordPress plugin versions prior to 2.51 Description: The issue arises from unvalidated input in the 301 Redirects - Easy Redirect Manager WordPress plugin. Specifically, versions before 2.51 did not...
PT-2021-17862 · Seo Panel · Seo Panel
Name of the Vulnerable Software and Affected Versions: Seo Panel version 4.8.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the "alerts.php" endpoint and the from time parameter. Recommendations: For Seo Panel version 4.8.0, consider disabling...
CVE-2020-28466
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightene...
CVE-2020-28466 Denial of Service (DoS)
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightene...
Home-Office Photos: A Ripe Cyberattack Vector
That photo that appears when someone disables his or her Zoom video, or those photos of a remote worker’s home office shared on Instagram may seem innocuous and playful. However, they could become ammunition for threat actors to launch targeted scams and put personal and critical data at risk, a...
Authorization Bypass
fastify-reply-from is vulnerable to authorization bypass. An attacker is able to escape the prefix of the proxied backend service and access restricted service such as the parent of the base URL...
Prefix escape
Overview In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is...
Prefix escape
Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...
GHSA-QMW8-3V4G-GWJ4 Prefix escape
Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...
Design/Logic Flaw
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...
CVE-2021-21321
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...
CVE-2021-21321 Prefix escape
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...
CVE-2021-21321
The CVE affects the npm package fastify-reply-from (a Fastify plugin used to forward requests to a backend). In versions prior to 4.0.2, a crafted URL could escape the proxied backend’s prefix (for example base URL /pub/), allowing access to resources that should be out of scope. Impact is data c...
fastify-reply-from 存在输入验证错误漏洞
Matteo Collina fastify-reply-from is Matteo Collina an open source application . It is used to forward the current http request to another server. A security vulnerability exists in fastify-reply-from before version 4.0.2, which can be exploited to escape the prefix of a proxy backend service by...
Experts Find a Way to Learn What You're Typing During Video Calls
A new attack framework aims to infer keystrokes typed by a target user at the opposite end of a video conference call by simply leveraging the video feed to correlate observable body movements to the text being typed. The research was undertaken by Mohd Sabra, and Murtuza Jadliwala from the...
5 Security Lessons for Small Security Teams for the Post COVID19 Era
A full-time mass work from home WFH workforce was once considered an extreme risk scenario that few risk or security professionals even bothered to think about. Unfortunately, within a single day, businesses worldwide had to face such a reality. Their 3-year long digital transformation strategy w...
CVE-2020-36249
creationtimestamp| type| source ---|---|--- 2021-02-19 12:51:05+00:00| seen| https://t.me/cibsecurity/23844...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oracle Jul 2020 CPU plus one additional vulnerability and Oracle deferred from Jan 2020
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR10-FP65 and Version 8 SR6-FP10 used by IBM Tivoli Application Dependency Discovery Manager TADDM. These issues were disclosed as part of the IBM Java SDK updates in Jul2020 and some were deferred from...
Security fix for the ALT Linux 9 package postgresql12-1C version 12.5-alt4
Feb. 11, 2021 Alexei Takaseev 12.5-alt4 - Fix permission checks on constraint violation errors on partitions. Fixes CVE-2021-3393 - Re-applay patch from 1C...