PHP Event Calendar Lite Edition is vulnerable to SQL injection

PHP Event Calendar is an open source AJAX-based multi-user modern event calendar. It is easy to integrate and fully customizable.PHP Event Calendar Lite Edition is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to obtain sensitive database data...

Microsoft is recognized as a Leader in the 2021 Forrester Wave for Unified Endpoint Management

Microsoft is honored to be recognized as a Leader in The Forrester Wave: Unified Endpoint Management UEM, Q4 2021 report for our ability to help customers on their path to modern endpoint management. Microsoft Endpoint Manager—which brings together Microsoft Intune for cloud endpoint management a...

Json-Ptr type obfuscation vulnerability

Json-Ptr is a full implementation of Json pointer Rfc 6901 for Nodejs and modern browsers. a security vulnerability exists in Json-Ptr, which stems from a design or implementation impropriety in the code development process of a web system or product. No details of the vulnerability are currently...

WordPress Modern Events Calendar Lite plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Modern Events Calendar Lite plugin has a cross-site scripting vulnerability in versions prior...

json-ptr 安全漏洞

Json-Ptr is a full implementation of Json pointer Rfc 6901 for Nodejs and modern browsers. a security vulnerability exists in Json-Ptr, which stems from a design or implementation impropriety in the code development process of a web system or product. No details of the vulnerability are currently...

CVE-2021-24716

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

CVE-2021-24716

CVE-2021-24716 affects the WordPress plugin Modern Events Calendar Lite prior to 5.22.3. The issue is an authenticated stored Cross-Site Scripting (XSS) vulnerability caused by inadequate sanitization/escaping of user input in wp-admin settings. Impact is client-side script execution if an attack...

CVE-2021-24716 Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

WordPress 跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Modern Events Calendar Lite plugin has a cross-site scripting vulnerability in versions prior...

A Guide to Shift Away from Legacy Authentication Protocols in Microsoft 365

Microsoft 365 M365, formerly called Office 365 O365, is Microsoft's cloud strategy flagship product with major changes ahead, such as the deprecation of their legacy authentication protocols. Often stored on or saved to the device, Basic Authentication protocols rely on sending usernames and...

CVE-2021-39221

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due t...

Denial Of Service (DoS)

modern-async is vulnerable to denial of service. The 'forEachLimit' function in 'forEachLimit.mjs' does not handle concurrent parameters properly, allowing a malicious user to cause an application to crash...

CVE-2021-41167

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...

CVE-2021-41167

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...

Code injection

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...

CVE-2021-41167 Unlimited requests in modern-async

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...

CVE-2021-41167

CVE-2021-41167 concerns the open-source library modern-async, where the functions forEachSeries and forEachLimit fail to enforce concurrency limits as intended. Multiple connected documents confirm this behavior and note the issue affects the library’s ability to limit concurrent actions, potenti...

PT-2021-23141 · Unknown · Modern-Async

Name of the Vulnerable Software and Affected Versions: modern-async versions prior to 1.0.4 Description: The issue affects two functions in the modern-async library: forEachSeries and forEachLimit. These functions are supposed to limit the concurrency of certain actions, but they do not. As a...

Modern-Async 资源管理错误漏洞

Modern-Async is a modern JavaScript tool library for asynchronous operations using Async/Await and Promise. A resource management error vulnerability exists in modern-async that arises from improper design or implementation during code development for a networked system or product...

Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure

The theme allows unauthenticated users to manipulate the queryvars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request. POST /wp-json/csco/v1/more-posts Accept:...