CVE-2021-0265

The CVE-2021-0265 entry relates to an unvalidated REST API in the Juniper Networks AppFormix Agent that allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, granting full control of the environment. Affected products are Juniper Networks A...

rubygem-rest-client: unsanitized application logging

REST client for Ruby aka rest-client before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log...

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses

REST client for Ruby aka rest-client before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect...

PT-2021-12003 · Vaadin · Com.Vaadin:Flow-Server +1

Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin versions 15.0.0 through 15.0.4 Description: The issue is related to an insecure configuration of the default ObjectMapper in the affected software. This may expose sensitive data if t...

WordPress Multiple Vulnerabilities (Apr 2021) - Windows

WordPress is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Vulnerabilities fixed in WordPress

WordPress developers have fixed several vulnerabilities fixed. An authenticated remote malicious person could potentially exploit these vulnerabilities potentially exploit them to perform an XML External Entity XXE attack. This vulnerability is located in the way uploaded MP3 files are processed ...

WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure

Description The Latest Posts block in the WordPress editor can be exploited in a way that exposes password-protected posts and pages via the posts REST API when the "edit" context was used. This requires at least contributor privileges. PoC 1. As one user, create a new password protected post...

CVE-2021-0265

An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, when certain preconditions are performed by the attacker, thus granting the attacker full control over the...

BuddyPress < 7.3.0 - Multiple Authenticated REST API Vulnerabilities

The BuddyPress WordPress plugin released version 7.3.0, a maintenance & security release, which included fixes for various authenticated REST API authorisation vulnerabilities. The 7.3.0 release addresses four security issues: - A vulnerability was fixed that could allow a member to create a grou...

CVE-2021-28458

Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability...

Privilege escalation

Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability...

CVE-2021-28458

Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability...

CVE-2021-28458 Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability

...

CVE-2021-28458

CVE-2021-28458 corresponds to an Elevation of Privilege vulnerability in the Azure ms-rest-nodeauth library. The vulnerability affects the @azure/ms-rest-nodeauth component and allows an attacker with local access and user interaction to obtain elevated privileges, with a high impact on confident...

Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability

...

Microsoft Azure ms-rest-nodeauth 权限许可和访问控制问题漏洞

Microsoft Azure ms-rest-nodeauth is an application from Microsoft USA. It provides different node.js-based authentication mechanisms. Microsoft Azure ms-rest-nodeauth has a privilege permission and access control issue vulnerability that stems from an Azure ms-rest-nodeauth library elevation of...

WordPress ACF to REST API Plugin <= 3.1.0 IDOR Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113814";...

CVE-2021-24219

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...

CVE-2021-24220

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

Design/Logic Flaw

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...