11989 matches found
location.transdev.com Cross Site Scripting vulnerability OBB-2139704
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
WordPress SQL injection vulnerability
WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.A SQL injection vulnerability exists in Wordpress Plugin Alipay, which stems from the product...
Brute-Force Attacks Target Inboxes for Gift Card Data
Threat actors are compromising up to 100,000 inboxes daily in a campaign that targets gift card and customer-loyalty program data in hopes of reselling it or cashing in on freebies, a security researcher has found. The actors behind the scam—outlined in a post by Brian Krebs on Krebs on...
Rundeck Cross-Site Request Forgery Vulnerability
Rundeck is an open source automation service with a web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. a cross-site request forgery vulnerability exists in Rundeck, which stems from the fact that users with access to the "system" resource...
Microsoft SharePoint Server 2019 < 16.0.10376.20001 Multiple Vulnerabilities
According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...
DSA-4965-1 libssh - security update
Bulletin has no description...
Easy Social Icons < 3.0.9 - Reflected Cross-Site Scripting
The plugin does not escape the $SERVER'PHPSELF' input before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php/alert/XSS//?page=cnsssocialiconpage...
Data race in conqueue
Affected versions of this crate unconditionally implemented Send/Sync for QueueSender, allowing to send non-Send T to other threads by invoking &QueueSender.send. This fails to prevent users from creating data races by sending types like Rc or Arc to other threads, which can lead to memory...
All Vulnerabilities for elearning.kubg.edu.ua Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| elearning.kubg.edu.ua ---|--- Open Bug...
Design/Logic Flaw
Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to strlen to determine the ending location of the char passed in by the user, no checks are done to see if the passed in char is longer th...
Reddit: Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API
Summary: Attacker that does not have access to a private subreddit, can still affect Upvote Percentage of any posts in this private subreddit. He does that by calling /api/vote API and passing post id directly. What is Upvote Percentage?: F1407175 Impact: - Attacker can affect Upvote Percentage o...
CVE-2021-32798
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim...
AI Wrote Better Phishing Emails Than Humans in a Recent Test
Researchers found that tools like OpenAI's GPT-3 helped craft devilishly effective spearphishing messages...
GSD-2021-1001286 scsi: core: Fix bad pointer dereference when ehandler kthread is invalid
scsi: core: Fix bad pointer dereference when ehandler kthread is invalid This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.52 by commit...
WP Dialog <= 1.2.5.5 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Put the following payload in the Welcome message stcontent parameter of the...