Pentaho Business Analytics / Pentaho Business Server 9.1 Remote Code Execution

Product: Pentaho Business Analytics / Pentaho Business Server Vendor / Manufacturer: Hitachi Affected Versions: = 9.1 Vulnerability Type: Remote Code Execution through Pentaho Report Bundles Solution Status: Fix Released on public GitHub repository Manufacturer Notification: 8th February 2021...

ZOHO ManageEngine Log360 Access Control Error Vulnerability

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.ZOHO ManageEngi...

Python < 2.7.17, 3.x < 3.4.10, 3.5.x < 3.5.7, 3.6.x < 3.6.9, 3.7.x < 3.7.3 Cookie domain check returns incorrect results (bpo-35121) - Linux

Python is prone to an improper input validation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2021-2639)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SAP Solution Manager Missing Authentication for Critical Function Vulnerability

SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager...

WordPress WP DSGVO Tools (GDPR) plugin <= 3.1.22 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Ramuel Gall WordFence in WordPress WP DSGVO Tools GDPR plugin versions = 3.1.22. Solution Update the WordPress WP DSGVO Tools GDPR plugin to the latest available version at least 3.1.24...

WordPress GenerateBlocks plugin <= 1.3.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress GenerateBlocks plugin versions = 1.3.5. Solution Update the WordPress GenerateBlocks plugin to the latest available version at least 1.4.0...

Huawei Data Communication: Out of Bounds Write Vulnerability in Some Huawei Products (huawei-sa-20211020-01-outofwrite)

There is an out of bounds write vulnerability in some Huawei products. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

WordPress Cookie Notice & Compliance for GDPR / CCPA Plugin < 2.1.2 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2020-7867

An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of...

Input validation

An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of...

CVE-2020-7867

CVE-2020-7867 describes an improper input validation vulnerability in the Helpu solution, affecting the viewer component that receives files from an agent running with administrator privileges. The underly­ing issue allows a local attacker to create arbitrary files and potentially execute code in...

CVE-2020-7867 Helpu arbitrary file creation vulnerability

An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of...

Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD

GoCD, written in Java, is a popular CI/CD solution with a large range of users from NGOs to Fortune 500 companies with billions of dollars in revenue. Naturally, this makes it a critical piece of infrastructure and an extremely attractive target for attackers. In order to automate build and relea...

Mahara <= 20.10 CSRF Vulnerability

Mahara is prone to a cross-site request forgery CSRF vulnerability that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a...

PT-2021-12688

Name of the Vulnerable Software and Affected Versions: Helpu solution affected versions not specified Description: The issue is related to improper input validation, allowing a local attacker to create and execute files arbitrarily without using the file transfer menu. This is possible because th...

WordPress Registrations for the Events Calendar plugin <= 2.7.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Registrations for the Events Calendar plugin versions = 2.7.4. Solution Update the WordPress Registrations for the Events Calendar plugin to the latest available version at least 2.7.5...

payroll-solution.com Improper Access Control vulnerability OBB-2208514

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress HashThemes Demo Importer plugin <= 1.1.1 - Improper Access Control allowing content deletion vulnerability

Improper Access Control allowing content deletion vulnerability discovered by Ramuel Gall WordFence in WordPress HashThemes Demo Importer plugin versions = 1.1.1. Solution Update the WordPress HashThemes Demo Importer plugin to the latest available version at least 1.1.2...

Hardware-grade enterprise authentication without hardware: new SIM security solution for IAM

The average cost of a data breach, according to the latest research by IBM, now stands at USD 4.24 million, the highest reported. The leading cause? Compromised credentials, often caused by human error. Although these findings continue to show an upward trend in the wrong direction, the challenge...