CVE-2021-31157

Summary (CVE-2021-31157): WordPress WPGraphQL plugin versions = 1.3.6. If upgrading is not possible, monitor for unusual query loads and consider disabling batching as a temporary workaround (note: explicit workaround details cited in sources).

CVE-2021-35470

The CVE placeholder CVE-2021-35470 is superseded by concrete details from connected sources: WordPress Inline Related Posts plugin (

catalog.carnegiestout.org Cross Site Scripting vulnerability OBB-2536409

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2018-7168

OpenAFS has a vulnerability tracked as CVE-2018-7168. Mageia/MGASA-2021-0509 notes that in-the-wild AFS3 clients could improperly construct ACLs and store them via RXAFS_StoreACL (opcode 134), with a defensive measure implemented by introducing a new RXAFS_StoreACL opcode (164) to identify proper...

CVE-2021-25632

CVE-2021-25632 is a LibreOffice vulnerability with code execution impact. Affected products are LibreOffice 7.0.x before 7.0.6 and 7.1.x before 7.1.3. The issue arises from an insecure handling path leading to arbitrary code execution. Some connected sources also reference an update to LibreOffic...

CVE-2021-29270

CVE-2021-29270 is referenced in the Mageia/MGASA-2021-0365 advisory as a vulnerability in systemd. The issue affects systemd versions 220–248, where a memory allocation with an excessive size value (involving strdupa and alloca for a pathname controlled by a local attacker) can crash the operatin...

CVE-2019-19233

The connected OpenVAS/Mageia OSV/OSVDB entries document CVEs related to sudo in CVE-2019-19232 and CVE-2019-19234. The advisory MGASA-2020-0246 explains that sudo could run commands with unknown user/group ids when configured with aliases like ALL, potentially letting sudo impersonate non-existen...

CVE-2017-10516

CVE-2017-10516 is linked to a cross-site scripting (XSS) vulnerability in Pallets Werkzeug prior to 0.11.11. The issue resides in the render_full function within the debug/tbtools.py debugger, allowing remote attackers to inject arbitrary script/HTML via an exception message. Affected product/ver...

CVE-2013-2320

CVE-2013-2320 is referenced in Mageia/MGASA-2015-0156 as SSLv2 support still being available within Mono’s TLS stack. The connected OpenVAS entry and OSV/Mageia advisory confirm the TLS-related issues are addressed in updated Mono packages (the advisory notes a TLS impersonation issue (CVE-2015-2...

unisar.reumatologia.org.ar Cross Site Scripting vulnerability OBB-2505943

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-24812

Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructe...

Cross-Site Scripting (XSS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Octosuite - Advanced Github OSINT Framework

Simply gatherOSINT on Github users and organizations like a god  FEATURES Fetches organization info Fetches user info Fetches repository info Returns contents of a path from a repository Returns a list of repos owned by an organization Returns a list of repos owned by a user Returns a list of...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

Conti?s Hacker Manuals ? Read, Reviewed & Analyzed

Conti is a notorious ransomware group that targets high-revenue organizations. They were first detected in 2020, and appear to be based in Russia. It is believed that the group is the successor to Ryuk ransomware group. According to Chainalysis, The ransomware group was the highest grossing of al...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token allowing privilege escalation to organization owner. Fixed in v202107-1.

...

Hive ransomware impacts California non-profit health organisation

Ransomware authors are once again targeting health services, holding important files to ransom and impacting potentially vital services. On this occasion, the victims are a non-profit organisation assisting people with their healthcare needs in California. When Hive ransomware strikes The victim,...

CVE-2012-3905

VMware VMSA-2012-0008/0008.1 documents CVE-2012-3905 among several COS kernel and libxml2 issues affecting ESX/Service Console. The advisory bundles multiple CVEs (e.g., CVE-2011-3191/4348, CVE-2012-0028, CVE-2010-4008, CVE-2011-0216/1944/2834/3919) and specifies remediation via specific patches:...

CVE-2021-41741

CVE-2021-41741 is addressed in the openSUSE/OpenSSL Nextcloud updates. The issue is described as high memory usage when generating a preview for a broken image in Nextcloud Server. Affected software is Nextcloud Server (self-hosted cloud platform); the root cause is related to image preview handl...