WordPress Master Slider plugin <= 3.7.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vulnerability-Lab in WordPress Master Slider plugin versions = 3.7.0. Solution Update the WordPress Master Slider plugin to the latest available version at least 3.7.1...

WordPress Imagements plugin <= 1.2.5 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability

Unauthenticated Arbitrary File Upload leading to Remote Code Execution RCE vulnerability discovered by Jin Huang in WordPress Imagements plugin versions = 1.2.5. Solution Plugin closed. Deactivate and delete...

VulnCheck KEV: CVE-2020-6207

SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager...

Diagnostics Agent in Solution Manager, stores unencrypted credentials for Solution Manager server

This module retrieves the secstore.properties file on a SMDAgent. This file contains the credentials used by the SMDAgent to connect to the SAP Solution Manager server. Module Options msf use post/multi/sap/smdagentgetproperties msf postsmdagentgetproperties show actions ...actions... msf...

Fedora: Security Advisory for perl-Net-Netmask (FEDORA-2021-3d96cfe6a3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-24186

The tutoransweringquizquestion/getanswerbyid function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students...

CVE-2021-24184 Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions...

CVE-2021-24185

The CVE-2021-24185 affects the Tutor LMS WordPress plugin prior to version 1.7.7. The vulnerability lies in the tutor_place_rating AJAX action, where blind and time-based SQL injections allow exploitation by a student attacker. Impact, as stated, is exposure of data through SQL injection; exploit...

CVE-2021-30002

A flaw memory leak in the Linux kernel webcam device functionality was found in the way user calls ioctl that triggers videousercopy function. The highest threat from this vulnerability is to system availability. Mitigation To mitigate this issue, prevent the module v4l2-common from being loaded...

Fedora: Security Advisory for webkit2gtk3 (FEDORA-2021-864dc37032)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

How Cyrebro Can Unify Multiple Cybersecurity Defenses to Optimize Protection

Many enterprises rely on more than one security tool to protect their technology assets, devices, and networks. This is particularly true for organizations that use hybrid systems or a combination of cloud and local applications. Likewise, companies whose networks include a multitude of smartphon...

BlueVoyant optimizes customer security with Microsoft security services

This blog post is part of the Microsoft Intelligent Security Association MISA guest blog series. Learn more about MISA. What a year it has been. The rapid and unexpected transition to work from home is one of the biggest issues affecting companies of all sizes and industries in 2020. As companies...

Fedora: Security Advisory for spamassassin (FEDORA-2021-bf06dcffa8)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-21398

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3...

CVE-2021-21398 Possible XSS injection through DataColumn Grid class

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3...

WordPress Findeo premium theme <= 1.2.6 - Authenticated Insecure Direct Object References (IDOR) vulnerability

Authenticated Insecure Direct Object References IDOR vulnerability discovered by m0ze Patchstack Red Team in WordPress Findeo premium theme versions = 1.2.6. Solution Update the WordPress Findeo premium theme to the latest available version at least 1.3.1...

Unspecified vulnerability in Performance Manager

Broadcom CA Performance Management is an IT monitoring solution from Broadcom. It is designed to monitor and manage IT systems and network infrastructures. A security vulnerability exists in Performance Manager through 6.3.2.12, which can be exploited by an attacker to cause an escalation of...

Zoom Client Screen Sharing Vulnerability (ZSB-21001) - Windows

The Zoom Client is prone to a vulnerability in the Application Window Screen Sharing Functionality. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

SAP Solution Manager 7.2 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Solution Manager remote unauthorized OS commands execution', 'License' = MSFLICENSE, 'Author' = 'Yvan Genuer', @1ggy The researcher who...

WordPress AccessAlly premium plugin <= 3.5.6 - $_SERVER Superglobal Leakage vulnerability

$SERVER Superglobal Leakage vulnerability discovered by Till Krüss in WordPress AccessAlly premium plugin versions = 3.5.6. Solution Update the WordPress AccessAlly premium plugin to the latest available version at least 3.5.7...