CVE-2021-21015

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required...

CVE-2021-21015: Improper Neutralization of Special Elements used in an OS Command

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required...

CVE-2021-21015

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required...

PT-2021-2183 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to an OS command injection via the customer attribute save controller. Successful exploitation could...

ExpressionEngine: PHP Code Injection through "Translate::save()" method

A vulnerability was identified and fixed that could have allowed attackers to inject and execute arbitrary PHP code through improperly sanitized user input...

DEBIAN-CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

PT-2021-14392

Name of the Vulnerable Software and Affected Versions: Mechanize versions 2.0.0 through 2.7.6 Description: Mechanize is an open-source ruby library that makes automated web interaction easy. Affected versions of Mechanize allow for OS commands to be injected using several classes' methods which...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local...

Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting

Exploit Title: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting Date: 02-12-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://invisioncommunity.com/ Software Link: https://invisioncommunity.com/buy Version: 4.5.4 Tested on: Windows 10/Kali Linux CVE:...

openSUSE Security Update : podman (openSUSE-2020-2039)

This update for podman fixes the following issues : Security issue fixed : - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API bsc1176804. Non-security issues fixed : - add dependency to timezone package or podman...

CVE-2020-8956

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

CVE-2020-8956

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

CVE-2020-8956

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

CVE-2020-8956

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

PT-2020-20394

Name of the Vulnerable Software and Affected Versions Pulse Secure Desktop Client versions 9.0Rx through 9.0R4 Pulse Secure Desktop Client versions 9.1Rx through 9.1R3 Description The issue reveals users' passwords if the Save Settings feature is enabled. Recommendations For Pulse Secure Desktop...

CVE-2020-8956: Weak Password Requirements

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled...

Dell EMC NetWorker Incorrect Privilege Assignment Vulnerability

Dell EMC NetWorker is a suite of unified backup and recovery software from Dell USA. The software provides backup and recovery, deduplication elimination, backup reporting and other features. A security vulnerability exists in Dell EMC NetWorker versions prior to 19.3.0.2 that stems from a failur...

The vulnerability of the Foxit PhantomPDF PDF editing program and the Foxit PDF viewer program, related to data conversion errors, allows a perpetrator to execute arbitrary code.

The vulnerability of the Foxit PhantomPDF PDF editing program and the Foxit PDF viewer program is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code using the “Save” command...

CVE-2020-12670

XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A...

CVE-2020-12670

XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A...