postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption...

CVE-2021-21604

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator...

CVE-2021-21604

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator...

The vulnerability of the WebGL component (a web-based graphics library) in browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows attackers to disclose protected information.

The vulnerability of the WebGL component a web-based graphics library in browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

Kubernetes: Index Out Of Bounds in protobuf unmarshalling

Report Submission Form Summary: I have recently discovered a bug in the gogo/protobuf code generator. This bug allows for an index out of bounds when unmarshalling certain protobuf objects. The bug is that a check is lacking when skipping certain bytes. There are numerous occurrences of this bug...

WordPress Advanced Access Manager plugin Handling Logic Error Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Advanced Access Manager plugin versions prior to 6.6.2,...

PT-2021-7023 · Nginx · Nginx Ingress Controller

Name of the Vulnerable Software and Affected Versions: NGINX Ingress Controller versions 1.x through 1.12.3 NGINX Ingress Controller versions 2.x through 2.0.3 Description: The issue is related to insufficient permission assignment checking for a critical resource in the NGINX Ingress Controller...

Exploit for Improper Authentication in Microsoft

CVE-2020-0688 A remote code execution vulnerability exists in...

CVE-2020-35932

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...

Deserialization of untrusted data

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...

CVE-2020-35938

PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be...

CVE-2020-35932

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...

CVE-2020-35932

The CVE concerns the WordPress Newsletter plugin prior to version 6.8.2, where an insecure deserialization flaw exists in the tpnc_render AJAX path. An authenticated user with minimal privileges (e.g., a subscriber) can submit options[inline_edits] data to wp-admin/admin-ajax.php, leading to unse...

The vulnerability of the SAP Business Objects Business Intelligence Platform lies in its lack of security measures to protect the website structure. This allows attackers to carry out XSS attacks.

The vulnerability of the SAP Business Objects Business Intelligence Platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

The vulnerability of the SAP Business Objects Business Intelligence Platform lies in its lack of security measures to protect the website structure. This allows attackers to carry out XSS attacks.

The vulnerability of the SAP Business Objects Business Intelligence Platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

Prototype Pollution in yowainwright/common-utilities

Description @common-utilities/merge-objects is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var a = require"@common-utilities/merge-objects" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " +...

Prototype Pollution in bonnevoyager/nested-objects-util

Description nested-objects-util is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var unflatten = require"nested-objects-util" console.log"Before : " + .polluted; unflatten"proto.polluted": "Yes! Its Polluted" console.log"After : " + .polluted; 2...

Foxit 3D Plugin Beta 9.x < 9.7.4.29600 / 10.x < 10.1.0.37494 RCE

The version of the Foxit 3D plugin installed on the remote Windows host is 9.x prior to 9.7.4.29600, or 10.x prior to 10.1.0.37494. It is, therefore affected by an Out-of-Bounds Read/Write or Stack-based Buffer Overflow vulnerability due to improper validation of data when parsing certain U3D...