736 matches found
Maintenance < 4.03 - Authenticated Stored XSS
The plugin does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them even when the unfilteredhtml capability is disallowed, which will be triggered in the frontend POST /wp-admin/admin.php?page=maintenance HTTP/1.1...
gnome-session bug fix and enhancement update
The gnome-session package manages the GNOME desktop session. It starts up other core components of GNOME and handles logouts and saving of the sessions. Bug Fixes and Enhancements: gnome-session kiosk-session support still isn't up to muster BZ1959505...
Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack. PoC Add the following...
The vulnerability of the data structure saving function in the OpenCV library, which is used for computer vision, image processing, and general numerical algorithms, allows a hacker to execute arbitrary code.
The vulnerability of the data structure saving function in the OpenCV library, which is used for computer vision, image processing, and general numerical algorithms, relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a malicious actor...
The vulnerability of Intel Falcon 8+ UAS AscTec Thermal Viewer lies in errors during resolution saving, which allows attackers to escalate their privileges.
The vulnerability of Intel Falcon 8+ UAS AscTec Thermal Viewer relates to errors during resolution saving. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the Thunderbird email client, as well as the Firefox and Firefox ESR browsers, relates to errors during permission saving, allowing a malicious actor to mistakenly assign a security certificate to an HTTP page.
The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to errors during the saving of permissions. Exploiting this vulnerability could allow a remote attacker to erroneously assign a security certificate to an HTTP page...
RHEL 8 : RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, enhance (Moderate) (RHSA-2021:1186)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1186 advisory. The ovirt-engine package provides the manager for virtualization environments. This manager enables admins to define hosts and networks, as...
CVE-2021-0443
In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. This could lead to local information disclosure across user profiles with no additional execution privileges needed. User interaction is needed for...
Content Copy Protection & Prevent Image Save <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them. -- PoC 1 | Authenticated Persistent XSS & XFS | Image saving disabled message text: ! POST...
What’s new on AWS Lambda in 2021
This article explores new updates and documentation for AWS Lambda in 2021. Lambda launched several new updates including run container images, cost saving initiatives, and expanded compute capacity...
EFB Tampering 1. Introduction and Class Differences
TL;DR Electronic flight bags EFBs are devices that flight crews use to help with flight management tasks Different airlines use different devices e.g. iPads, netbooks, custom devices Some are carried on by flight crew, others are built-in to the cockpit Some important functions are carried out by...
February 9, 2021—KB4601348 (Monthly Rollup)
None None...
Lumax Classic suffers from dll hijacking vulnerability (CNVD-2021-09953)
LU Master is a well-known free system tool software in China, providing free hardware authenticity identification, stability guarantee, system performance improvement, LU Master has hardware detection, hardware testing, system optimization, energy saving and cooling, driver installation, driver a...
January 21, 2021—KB4598298 (OS Build 18363.1350) Preview
None None...
CVE-2018-18688
The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or...
CVE-2018-18688
The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or...
Design/Logic Flaw
The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or...
CVE-2018-18688
The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or...
Code injection
An issue was discovered in the viewstatistics aka View frontend statistics extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data e.g., cleartext passwords if ext:felogin is...
Debian DLA-2424-1 : tzdata new upstream version
tzdata, the time zone and daylight-saving time data, has been updated to the latest version. - Revised predictions for Morocco's changes starting in 2023. - Macquarie Island has stayed in sync with Tasmania since 2011. - Casey, Antarctica is at +08 in winter and +11 in summer since 2018. -...