PT-2021-1392

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.48 and earlier Description: A crafted request uri-path can cause mod proxy to forward the request to an origin server chosen by the remote user. This issue is related to insufficient validation of incoming...

PT-2021-10299 · Laiketui · Laiketui

Name of the Vulnerable Software and Affected Versions: LaikeTui version 3 Description: The issue allows remote attackers to execute arbitrary code via the component "/index.php?module=member&action=add". This is a Cross Site Request Forgery CSRF issue. Recommendations: For LaikeTui version 3, as ...

PT-2021-6974 · Microsoft · Office Powerpoint +2

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to incorrect code generation management in Microsoft Office and Microsoft 365 Apps for...

PT-2021-22382 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.19.0 Description: The issue allows remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the "/rest/api/1.0/render" endpoint...

IBM Security Secret Server 输入验证错误漏洞

IBM Security Secret Server is a privileged access management solution from IBM Corporation. The product supports password management, privileged account identification, and privileged session access monitoring logs.A security vulnerability exists prior to IBM Security Secret Server 11.0, which...

PT-2021-21559 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.0 SP2 Description: A vulnerability has been identified that allows an unauthenticated attacker in the same network to abuse send-to-sleep notifications and cause a Denial-of-Service condition ...

Siemens Siveillance OIS

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Siveillance OIS Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to execute code on...

CVE-2021-24490

The Email Artillery MASS EMAIL WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well...

Sql injection

The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages...

CVE-2021-24728

The CVE-2021-24728 issue affects the WordPress plugin Membership & Content Restriction – Paid Member Subscriptions, specifically versions before 2.4.2. The root cause is that the plugin does not sanitise, validate, or escape the order and orderby parameters before using them in SQL statements, re...

PT-2021-16102 · WordPress · Per Page Add To Head

Name of the Vulnerable Software and Affected Versions: Per page add to head WordPress plugin versions prior to 1.4.4 Description: The issue is related to the lack of CSRF checks when saving settings, which could allow attackers to make changes to the settings of a logged-in admin. Additionally, t...

WordPress plugin Membership & Content Restriction – Paid Member Subscriptions SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

The vulnerability of the server-based corporate software for project monitoring and management, RoboHelp Server, arises due to an incorrect path limitation to the restricted access catalog. This allows attackers to read arbitrary files.

The vulnerability of server-based corporate software for project monitoring and management with RoboHelp Server exists due to an incorrect limitation on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files using a specially...

The vulnerability of the bl_categories_help.php file, a parental control file for Internet CTparental, allows a violator to execute any command or run any code.

The vulnerability of the blcategorieshelp.php file, a parental control file for Internet CTparental, exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious user to execute arbitrary code or perform arbitrary...

PT-2021-4511 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.8 Description: The issue allows an authenticated but low-privileged user, such as a contributor or author, to execute cross-site scripting XSS in the editor, bypassing restrictions imposed on users who do not hav...

CVE-2021-1836

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and iPadOS 14.5, tvOS 14.5. A local user may be able to create or modify privileged files...

ROS-2-1170

2.1170 Vulnerabilities in Squid Proxy Server 1. Vulnerability description: Issues are present in the code processing the "@" block at the beginning of a URL "user@host" and allow bypassing access restriction rules, poisoning cache contents and performing a cross-site scripting attack.Identifier o...

ROS-2-1218

2.1218 Vulnerabilities in Squid Proxy Server 1. Vulnerability description: Problems are present in the code processing the "@" block at the beginning of a URL "user@host" and allow bypassing access restriction rules, poisoning cache contents and performing a cross-site scripting attack.Identifier...

ROS-2-800

2.800 Vulnerabilities in Squid Proxy Server 1. Vulnerability description: Problems are present in the code processing the "@" block at the beginning of a URL "user@host" and allow bypassing access restriction rules, poisoning cache contents and performing a cross-site scripting attack.Identifier...

CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...