Security Bulletin: IBM Sterling Order Management is affected by a vulnerability (CVE-2016-5953)

Abstract Security Bulletin: IBM Sterling Order Management is affected by a vulnerability CVE-2016-5953 Body This has been analyzed by the internal teams and recommended fixes released for the same. All versions are affected and details of fixes are available here: "Business...

Security Bulletin: IBM Sterling Order Management is vulnerable to cross-site scripting

Summary IBM Sterling Order Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details CVEI...

DEBIAN-CVE-2021-42574

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and...

Cross-site Scripting (XSS)

Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Cross-site Scripting XSS by using the index.php?s=order&ids="alert1; payload. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script...

CVE-2021-22037

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path...

CVE-2021-22037

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path...

Command injection

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path...

CVE-2021-22037

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path...

CVE-2021-22037

CVE-2021-22037 affects Windows installers produced with InstallBuilder. The issue arises when manipulating the Windows registry: InstallBuilder invokes reg.exe but does not enforce the absolute path, allowing search-path hijacking to substitute a malicious reg.exe. This path interception could ca...

Zales.com Leaked Customer Data, Just Like Sister Firms Jared, Kay Jewelers Did in 2018

In December 2018, bling vendor Signet Jewelers fixed a weakness in their Kay Jewelers and Jared websites that exposed the order information for all of their online customers. This week, Signet subsidiary Zales.com updated its website to remediate a nearly identical customer data exposure. Last...

WordPress Mangboard plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. WordPress Mangboard plugin has a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in order parameters, and can be used by attackers to...

CVE-2021-26609

A vulnerability was found in MangboardWordPress plugin. A SQL-Injection vulnerability was found in ordertype parameter. The ordertype parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information...

Sql injection

A vulnerability was found in MangboardWordPress plugin. A SQL-Injection vulnerability was found in ordertype parameter. The ordertype parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information...

WordPress和WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. WordPress Mangboard plugin has a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in order parameters, and can be used by attackers to...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Check & Log Email prior to version 1.0....

Rocket.Chat: Retrospective change of message timestamp and order

Vulnerability description not provided...

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

Description No CSRF in duplicate rule, and modifying the order of the rule group Proof of Concept Click Me! Click Me! Click Me! Impact This vulnerability is capable of tricking admin users to duplicate rule and modifying order of rule groups Permalinks selected with reference to this report:...

GSD-2021-1001749 md: fix a lock order reversal in md_alloc

md: fix a lock order reversal in mdalloc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...

UVI-2021-1001749 md: fix a lock order reversal in md_alloc

md: fix a lock order reversal in mdalloc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...

UVI-2021-1001666 md: fix a lock order reversal in md_alloc

md: fix a lock order reversal in mdalloc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.70 by commit...