PT-2021-16193 · WordPress · The Weather Effect

Name of the Vulnerable Software and Affected Versions: The Weather Effect WordPress plugin versions prior to 1.3.4 Description: The issue is related to the lack of CSRF checks and input validation when saving settings, which could lead to a Stored Cross-Site Scripting issue. This means that an...

GHSA-VJMG-PC8H-P6P8 Out of bounds read in fltk

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is an out-of bounds read because the pixmap constructor lacks pixmap input validation...

CVE-2021-24500

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially...

Lenovo BIOS 安全漏洞

Lenovo Bios is a boot method for computers from the Chinese company Lenovo Lenovo. It is used to boot the system during computer startup. A security vulnerability exists in the Lenovo BIOS that stems from a lack of authentication measures in the system, which could allow an attacker to elevate...

CVE-2021-24356

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activateplugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites...

BELL-CVE-2021-22543 CVE-2021-22543 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2021-29478 CVE-2021-29478 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2021-26291 CVE-2021-26291 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2021-2161 CVE-2021-2161 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2021-2163 CVE-2021-2163 does not affect BellSoft software

Bulletin has no description...

GHSA-2FW4-MGQ9-39CX Code Injection in oauth2-server

"oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not...

BELL-CVE-2021-30178 CVE-2021-30178 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2021-26708 CVE-2021-26708 does not affect BellSoft software

Bulletin has no description...

CVE-2020-36173

The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields...

BELL-CVE-2020-8695 CVE-2020-8695 does not affect BellSoft software

Bulletin has no description...

CVE-2020-9669

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a lack of exploit mitigations vulnerability. Successful exploitation could lead to privilege escalation...

BELL-CVE-2020-14550 CVE-2020-14550 does not affect BellSoft software

Bulletin has no description...

CVE-2020-15302

In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian case, which allows attackers to cause a denial of service locking or a takeover...

CVE-2020-13814: Use After Free

An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary...

The vulnerability of the Slurm resource manager lies in the lack of protection for SQL query structures, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Slurm resource manager is related to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...