PT-2021-15879

Name of the Vulnerable Software and Affected Versions iFlyChat WordPress plugin versions prior to 4.7.0 Description The issue is related to an authenticated Stored Cross-Site Scripting problem. It occurs because the APP ID setting is not properly sanitized before being outputted back in the page...

CVE-2020-27377

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

CVE-2020-27377

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

Cross site scripting

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

CVE-2020-27377

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

CVE-2021-24331

The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psbdistance, psbbuttonsize, psbspeed, only validating them client side. This could allow high privilege users such as admin to set XSS payloads in them...

CVE-2020-26670

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

CVE-2020-26670: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

PT-2021-11256

Name of the Vulnerable Software and Affected Versions: BigTree CMS versions 4.4.10 and earlier Description: A vulnerability has been discovered that allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

CVE-2020-27377: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

PT-2021-11387

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14 Description: A cross-site scripting XSS issue was found in the Administrator panel on the 'Setting News' module, allowing an attacker to execute arbitrary web scripts. Recommendations: For CMS Made Simple versio...

CVE-2021-33506

jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrictroomcreation is set by default. This can allow an attacker to circumvent conference moderation...

Jitsi Meet jitsi-meet-prosody安全漏洞

8X8 Docker Jitsi Meet is a tool for building Jitsi Meet videoconferencing solutions in Docker from 8x8 USA. A security vulnerability exists in jitsi-meet-prosody in versions of Jitsi Meet prior to 5026, which stems from an uncertainty in the default setting of restrictroomcreation. No detailed...

embedded web server software Stack Buffer Overflow

The vulnerability of the webSettingProfileGeneral function in the embedded web server software is related to buffer overflows in the stack due to deficiencies in input data processing. Exploiting this vulnerability can allow an attacker to enhance their privileges, execute arbitrary code, or caus...

NetworkManager and libnma security, bug fix, and enhancement update

libnma 1.8.30-2 - Rebuild with new gtk-doc to fix multilib issues rh 1853152 NetworkManager 1.30.0-7.0.1 - add connectivity check via Oracle servers Orabug: 32051972 - Disable the build of NetworkManager-config-connectivity- subpackage for 8.3 1:1.30.0-7 - initrd: set multi-connect=single for...

Easy Preloader <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise its setting fields, leading to authenticated admin+ Stored Cross-Site scripting issues PoC Step 1: Install the plugin "Easy Preloader" Step 2: Enter the payload below in the text field "Choose overlay color" or any other text fields in the plugin's settings...

NetworkManager: Profile with match.path setting triggers crash

A flaw was found in NetworkManager. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability...

openSUSE Security Update : jhead (openSUSE-2021-743)

This update for jhead fixes the following issues : jhead was updated to 3.06.0.1 - lot of fuzztest fixes - Apply a whole bunch of patches from Debian. - Spell check and fuzz test stuff from Debian, nothing useful to human users. - Add option to set exif date from date from another file. - Bug fix...

CVE-2021-24315

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated admin+ Stored XSS issues...

EFB Tampering 3. Take-off pt2

Take-off Performance Part 2: Flap, Trim, Database and Sources of Data Target: FLAP SETTING There are various forms of flaps and slats. The difference between the two and the technicalities of how they work is outside the scope of this blog. As a general rule flaps extend from the rear/trailing ed...