WordPress Qtranslate Slug plugin <= 1.1.18 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by NinTechNet in WordPress Qtranslate Slug plugin versions = 1.1.18. Solution This plugin has been closed as of February 11, 2021 and is not available for download. Reason: Security Issue...

Ubuntu 18.04 LTS / 20.04 LTS : GNOME Autoar regression (USN-4937-2)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4937-2 advisory. USN-4937-1 fixed a vulnerability in GNOME Autoar. The update caused a regression when extracting certain archives. This update fixes the problem...

Command Execution Vulnerability in DeepSync IPSec VPNs

DeepTrust IPSec VPN provides an all-in-one networking solution for small and medium-sized branches. A command execution vulnerability exists in the DeepSync IPSec VPN, which can be exploited by an attacker to gain control of the server...

Design/Logic Flaw

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

CVE-2021-32641

CVE-2021-32641 affects Auth0-lock (Auth0’s signin solution). Versions up to and including 11.30.0 are vulnerable to a reflected XSS when user input from URL parameters is injected into the library’s flashMessage or languageDictionary features. The issue is addressed in version 11.30.1, which patc...

Command Execution Vulnerability in H3C SecPath Operations Audit System

Xinhua San Technology Co., Ltd. is a new IT solution provider, committed to become the most trusted partner for customers' business innovation and digital transformation. The main products are routers, big data, switches, IoT, cloud computing, servers and so on. A command execution vulnerability...

Logic Flaw Vulnerability in Techland MADP2.0 Mobile Financial Development Platform

Beijing Techland Software System Co., Ltd. is a banking IT solution provider. A logic flaw vulnerability exists in the Techland MADP2.0 mobile financial development platform. An attacker can utilize the vulnerability to add arbitrary users...

HealthForYou 1.11.1 / HealthCoach 2.9.2 User Enumeration Vulnerability

User enumeration through API Overview Advisory ID: TRSA-2104-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2104-01 Affected product: HealthForYou & Sanitas HealthCoach mobile and web applications Tested versions: HealthForYou 1.11.1...

h1-ctf: H1-CTF 100k Solution - Congratz on the 100k Rep todayisnew

Sharing the final flag for now. Writeup will come soon ██████ ██████████ Impact Takeover of admin account :...

FFmpeg heap buffer overflow vulnerability (CNVD-2021-42343)

FFmpeg is a complete solution for recording, converting and streaming audio and video. A heap buffer overflow vulnerability exists in getblockrow in libavfilter/vfbm3d.c in FFmpeg. An attacker could exploit this vulnerability to cause memory corruption...

Ubuntu: Security Advisory (USN-4972-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BigTree CMS Multiple Vulnerabilities (Sep 2020)

BigTree CMS is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Huawei Data Communication: Resource Management Error Vulnerability in Some Huawei Products (huawei-sa-20210519-01-resource)

There is a resource management error vulnerability in some Huawei Products. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

Huawei Data Communication: Denial of Service Vulnerability in Some Huawei Products (huawei-sa-20210519-02-dos)

There is a denial of service DoS vulnerability in some Huawei products. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Why adopt a data-centric solution for data privacy?

Enterprises understand the importance of having access to their consumers personal information. This data enables them to more easily build personal relationships with their audiences, using what they know about that audience to provide tailored experiences and recommendations. The internet has...

WordPress Gallery from files plugin <= 1.60 - Unauthenticated Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE vulnerability discovered by WPScanTeam in WordPress Gallery from files plugin versions = 1.60. Solution This plugin has been closed as of May 24, 2021 and is not available for download. This closure is temporary, pending a full review...

Multivendor Marketplace Solution for WooCommerce < 3.7.4 - Unauthenticated Arbitrary Product Comment

The plugin did not properly check for CSRF when saving a product comment, and took the user ID to link the comment to from user input. As a result, attackers can post arbitrary comment, as another user as well by manipulating the currentuserid parameter. PoC POST / HTTP/1.1 Accept:...

IBM Security Guardium Hardcoded Credentials Vulnerability (CNVD-2021-37144)

IBM Security Guardium is a comprehensive data protection solution that offers a full range of data security features from compliance support to dynamic data shielding. A hard-coded credentials vulnerability exists in IBM Security Guardium version 11.2. An attacker could exploit the vulnerability ...

Personal & Professional Challenges Facing SecOps Teams

On the frontline: revealing the personal and professional challenges facing SecOps teams. New research shows that security teams are struggling with overwhelming workloads, and organizations are lacking the solution...

Nette Framework RCE Vulnerability (CVE-2020-15227)

The Nette Framework is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...