GHSA-FW45-938V-P26J mootools-more vulnerable to prototype pollution

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype...

mootools-more vulnerable to prototype pollution

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype...

python39:3.9 and python39-devel:3.9 security update

An update is available for python-more-itertools, pytest, python-psycopg2, python-lxml, python-PyMySQL, python3x-six, python-toml, python-urllib3, PyYAML, python-attrs, python-iniconfig, python-requests, modwsgi, python3x-pip, python-py, python-chardet, python-pluggy, Cython, python-psutil,...

CVE-2021-24746

The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled which is the default setting, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24746

The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled which is the default setting, leading to a Reflected Cross-Site Scripting issue...

WordPress plugin Social Sharing Plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

CVE-2022-27212: Improper Neutralization of Input During Web Page Generation

Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches and more' parameter, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

@dolittle/node-red (>=2.0.0, <=2.2.5), @dolittle/node-red-infor-m3 (>=2.0.1, <=2.1.5) +50 more potentially affected by CVE-2019-10062 via aurelia-framework (>=1.0.0, <=1.3.1)

aurelia-framework NPM version =1.0.0, =2.0.0, =2.0.1, =1.2.1, =1.0.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11 and more Source cves: CVE-2019-10062 Source advisory: OSV:GHSA-M6J2-V3GQ-45R5...

5 Security Projects That Are Giving Back

Editor’s note: We had planned to publish our Hacky Holidays blog series throughout December 2021 – but then Log4Shell happened, and we dropped everything to focus on this major vulnerability that impacted the entire cybersecurity community worldwide. Now that it’s 2022, we’re feeling in need of...

DEBIAN-CVE-2021-45707

An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups...

CVE-2021-24925

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the currentmonthdivider parameter of its meclistloadmore AJAX call available to both unauthenticated and authenticated users before outputting it back in the response, leading to a Reflected Cross-Site...

CVE-2021-24925

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the currentmonthdivider parameter of its meclistloadmore AJAX call available to both unauthenticated and authenticated users before outputting it back in the response, leading to a Reflected Cross-Site...

PT-2021-16370

Name of the Vulnerable Software and Affected Versions: The Modern Events Calendar Lite WordPress plugin versions prior to 6.1.5 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the current month divider parameter of the "mec list load more" AJAX call is...

more-sc.com.br Improper Access Control vulnerability OBB-2243660

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Session Fixation in Gogs

CVE-2018-18925 Exploitation of CVE-2018-18925 a Remote Code Ex...

CVE-2021-38319

The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /morefromgoogle.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2...

CVE-2021-38319

The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /morefromgoogle.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2...

CVE-2021-38319

The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /morefromgoogle.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2...

CVE-2021-38319

CVE-2021-38319 affects the WordPress plugin More From Google (versions up to 0.0.2). The vulnerability is a Reflected XSS caused by a reflected $_SERVER["PHP_SELF"] in the file ~/morefromgoogle.php, enabling injection of arbitrary scripts. The connected sources confirm the affected component and ...

PT-2021-22036

Name of the Vulnerable Software and Affected Versions: More From Google WordPress plugin versions up to and including 0.0.2 Description: The issue allows attackers to inject arbitrary web scripts due to a reflected $ SERVER"PHP SELF" value in the /morefromgoogle.php file. This enables Reflected...