WordPress Browser and Operating System Finder plugin <= 1.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Imai Shinpei Cryptography Laboratory Tokyo Denki University in WordPress Browser and Operating System Finder plugin versions = 1.1. Solution Update the WordPress Browser and Operating System Finder plugin to the latest available version ...

PT-2021-23231 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: The issue affects Discourse, a platform for community discussion. A maliciously crafted request could cause an error response to be cached by...

FormatFuzzer - A Framework For High-Efficiency, High-Quality Generation And Parsing Of Binary Inputs

FormatFuzzer is a framework for high-efficiency, high-quality generation and parsing of binary inputs. It takes a binary template that describes the format of a binary input and generates an executable that produces and parses the given binary format. From a binary template for GIF, for instance,...

WordPress Event Manager for WooCommerce plugin <= 3.5.1 - Unauthenticated Arbitrary Elementor Template Import vulnerability

Unauthenticated Arbitrary Elementor Template Import vulnerability discovered by WPScanTeam in WordPress Event Manager for WooCommerce plugin versions = 3.5.1. Solution Update the WordPress Event Manager for WooCommerce plugin to the latest available version at least 3.5.3...

WordPress WP DSGVO Tools (GDPR) plugin <= 3.1.22 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Ramuel Gall WordFence in WordPress WP DSGVO Tools GDPR plugin versions = 3.1.22. Solution Update the WordPress WP DSGVO Tools GDPR plugin to the latest available version at least 3.1.24...

WordPress myCred plugin <= 2.2 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by bl4derunner in WordPress myCred plugin versions = 2.2. Solution Update the WordPress myCred plugin to the latest available version at least 2.3...

Fedora: Security Advisory for java-latest-openjdk (FEDORA-2021-f361564c6d)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for java-latest-openjdk (FEDORA-2021-b277e63494)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for java-latest-openjdk (FEDORA-2021-27ba6780e5)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2021-8235

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the btrfs component of the Linux kernel and involves a problem with the btrfs show devname function. The function searches for devices but finds none, leading to ...

WordPress Logo Showcase with Slick Slider plugin <= 1.2.4 - Arbitrary Media Title/Description/Alt Text/URL Update vulnerability

Arbitrary Media Title/Description/Alt Text/URL Update vulnerability discovered by apple502j in WordPress Logo Showcase with Slick Slider plugin versions = 1.2.4. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 1.2.5...

CVE-2021-41156

anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browsertoday hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craf...

Is There Really Such a Thing as a Low-Paid Ransomware Operator?

ARCHIVED STORY Is There Really Such a Thing as a Low-Paid Ransomware Operator? By Thibault Seret · October 18, 2021 Introduction Going by recent headlines you could be forgiven for thinking all ransomware operators are raking in millions of ill-gotten dollars each year from their nefarious...

PT-2021-23639 · Unknown +1 · Bluemonday +1

Name of the Vulnerable Software and Affected Versions: bluemonday versions prior to 1.0.16 for Go bluemonday versions prior to 0.0.8 for Python in pybluemonday Description: The bluemonday sanitizer does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements,...

Trend Micro HouseCall for Home Networks vulnerable to privilege escalation

Overview Trend Micro Incorporated has released a security update for HouseCall for Home Networks. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. Impact A user who can log in to the product may obtain administrative privileges. As a...

WordPress Catch Breadcrumb plugin <= 1.6 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Breadcrumb plugin versions = 1.6. Solution Update the WordPress Catch Breadcrumb plugin to the latest available version at least 1.7...

WordPress Header Enhancement plugin <= 1.4.3 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Header Enhancement plugin versions = 1.4.3. Solution Update the WordPress Header Enhancement plugin to the latest available version at least 1.5...

WordPress Autopilot SEO for WooCommerce plugin <=1.5.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Autopilot SEO for WooCommerce plugin versions =1.5.1...

Apache Struts Security Update (CVE-2012-1592)

Apache Struts is prone to a local code execution vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

CVE-2021-39121

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from...