PT-2021-23453

Name of the Vulnerable Software and Affected Versions webTareas versions 2.4 and earlier Description The issue allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sor cible, sor champs, and sor ordre HTTP POST...

PT-2021-23452

Name of the Vulnerable Software and Affected Versions webTareas versions 2.4 and earlier Description The issue allows an authenticated user to upload potentially dangerous files without restrictions by adding or replacing a personal profile picture. The affected endpoint is "/includes/upload.php"...

PT-2021-20604

Name of the Vulnerable Software and Affected Versions: The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin versions up to and including 1.5.7 Description: The issue is related to Cross-Site Request Forgery, which occurs due to a missing nonce check in the save theme function foun...

mysql:8.0 security, bug fix, and enhancement update

mysql 8.0.26-1 - Update to MySQL 8.0.26 8.0.25-1 - Update to MySQL 8.0.25 8.0.24-1 - Update to MySQL 8.0.24 - Upstreamed patch: mysql-main-cast.patch 8.0.23-1 - Update to MySQL 8.0.23 - Created mysql-fix-includes-robin-hood.patch - Created mysql-main-cast.patch 8.0.22-1 - Update to MySQL 8.0.22 -...

CVE-2021-38340

The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the updaterow parameter found in the /includes/addproduct.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-38352

The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedifymsg parameter found in the /includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8...

CVE-2021-38341

The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /includes/pluginsettings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10...

PT-2021-22072

Name of the Vulnerable Software and Affected Versions The Feedify – Web Push Notifications WordPress plugin versions up to and including 2.1.8 Description The issue allows attackers to inject arbitrary web scripts via the feedify msg parameter found in the /includes/base.php file, enabling...

PT-2021-22060

Name of the Vulnerable Software and Affected Versions Wordpress Simple Shop WordPress plugin versions up to and including 1.2 Description The issue allows attackers to inject arbitrary web scripts via the update row parameter found in the /includes/add product.php file, enabling Reflected...

GHSA-7VPH-P634-VRQF Command Injection in RaspAP 2.6.6

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

CVE-2021-38556

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

CVE-2021-38556

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

CVE-2021-38556: Improper Neutralization of Special Elements used in a Command

includes/configureclient.php in RaspAP 2.6.6 allows attackers to execute commands via command injection...

PT-2021-22208 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP version 2.6.6 Description: The issue allows attackers to execute commands via command injection in the includes/configure client.php file. This can lead to unauthorized access and control of the system. Recommendations: For RaspAP...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress...

Nagios XI Manage.php Directory Traversal (CVE-2021-3277)

A directory traversal vulnerability exists in Nagios XI. The vulnerability is due to insufficient validation of the request parameters in manage.php of the Custom-includes module...

CVE-2021-3277

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files...

CVE-2021-3277

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files...

Nagios XI code-related vulnerabilities

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An arbitrary file upload vulnerability exists in Nagios XI 5.7.5 and earlier versions. The vulnerability stems from improper validatio...

CVE-2021-3277: Unrestricted Upload of File with Dangerous Type

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files...