The vulnerability of Mozilla Maintenance Service allows attackers to escalate their privileges on Firefox ESR and Firefox browsers.

The vulnerability of the Mozilla Maintenance Service affects Firefox ESR and Firefox browsers due to synchronization errors when using a common resource. Exploiting this vulnerability can allow attackers to increase their privileges...

WordPress Maintenance Plugin < 4.03 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

The vulnerability of the microprogrammed software of Schneider Electric’s Modicon M340 programmable logic controllers lies in the insufficient checking of unusual or exceptional states. This allows a intruder to trigger a malfunction during maintenance.

The vulnerability of the microprogrammed software of Schneider Electric’s Modicon M340 programmable logic controller is related to insufficient testing of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to cause malfunctions during maintenance operations...

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium lies in the insufficient checking of unusual or exceptional states. This allows a intruder to trigger a malfunction in maintenance by using a specially crafted HTTP packet.

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium lies in the insufficient testing of unusual or exceptional states. Exploiting this vulnerability can allow an attacker operating remotely...

Detect Container Drift in Your Kubernetes Deployments

Discover how to maintain compliance and secure your Kubernetes containers with automated security policies and scanning...

CVE-2021-38612

In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL...

Directory traversal

In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL...

CVE-2021-38612

The CVE-2021-38612 entry concerns NASCENT RemKon Device Manager version 4.0.0.0. A directory traversal flaw exists in the log-reading function at maintenance/readLog.php, enabling an attacker to read arbitrary files via a specially crafted URL. Public references (NVD, Red Hat, CVE listings, and r...

CVE-2021-38612

In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL...

CVE-2021-24533

The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them even when the unfilteredhtml capability is disallowed, which will be triggered in the frontend...

CVE-2021-24533

The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them even when the unfilteredhtml capability is disallowed, which will be triggered in the frontend...

Cross site scripting

The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them even when the unfilteredhtml capability is disallowed, which will be triggered in the frontend...

CVE-2021-24533

CVE-2021-24533 affects the WordPress Maintenance plugin prior to version 4.03. The issue is an authenticated stored XSS where high-privilege users (e.g., admin) can inject payloads into certain plugin settings due to insufficient sanitization/escaping, with the payload triggered in the frontend e...

CVE-2021-24533 Maintenance < 4.03 - Authenticated Stored XSS

The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them even when the unfilteredhtml capability is disallowed, which will be triggered in the frontend...

Wordpress Plugin Maintenance 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Wordpress...

Security Bulletin: Multiple security vulnerabilities in WebSphere Application Server affect Predictive Maintenance and Quality and Predictive Maintenance Insights

Summary IBM WebSphere Application Server is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Vulnerabilities have been identified in WebSphere Application Server and the information about their fixes is published in below security bulletins...

Security Advisory 0064

Security Advisory 0064 . CSAF PDF Date: August 20th, 2021 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | August 20th, 2021 | Initial Release The CVE-ID tracking this issue: CVE-2021-28498 CVSSv3.1 Base Score: 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H The CVE-ID tracking this issu...

Baker Hughes Bently Nevada 3500

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Bently Nevada, a Baker Hughes subsidiary Equipment: 3500 Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. REPOSTED INFORMATION This advisory was originally posted to the...

RUSTSEC-2021-0139 ansi_term is Unmaintained

The maintainer has advised that this crate is deprecated and will not receive any maintenance. The crate does not seem to have much dependencies and may or may not be ok to use as-is. Last release seems to have been three years ago. Possible Alternatives The below list has not been vetted in any...

JVN#41646618: Huawei EchoLife HG8045Q vulnerable to OS command injection

EchoLife HT8045Q provided by Huawei is an ONT Optical Network Terminal device. It is equipped with the command line interface for network operators' maintenance purpose, which is disabled by default. When the command line interface is enabled, operators can interact with a certain restricted set ...