CVE-2021-21398 Possible XSS injection through DataColumn Grid class

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3...

WordPress Findeo premium theme <= 1.2.6 - Authenticated Insecure Direct Object References (IDOR) vulnerability

Authenticated Insecure Direct Object References IDOR vulnerability discovered by m0ze Patchstack Red Team in WordPress Findeo premium theme versions = 1.2.6. Solution Update the WordPress Findeo premium theme to the latest available version at least 1.3.1...

Unspecified vulnerability in Performance Manager

Broadcom CA Performance Management is an IT monitoring solution from Broadcom. It is designed to monitor and manage IT systems and network infrastructures. A security vulnerability exists in Performance Manager through 6.3.2.12, which can be exploited by an attacker to cause an escalation of...

Zoom Client Screen Sharing Vulnerability (ZSB-21001) - Windows

The Zoom Client is prone to a vulnerability in the Application Window Screen Sharing Functionality. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

WordPress AccessAlly premium plugin <= 3.5.6 - $_SERVER Superglobal Leakage vulnerability

$SERVER Superglobal Leakage vulnerability discovered by Till Krüss in WordPress AccessAlly premium plugin versions = 3.5.6. Solution Update the WordPress AccessAlly premium plugin to the latest available version at least 3.5.7...

SAP Solution Manager 7.2 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Solution Manager remote unauthorized OS commands execution', 'License' = MSFLICENSE, 'Author' = 'Yvan Genuer', @1ggy The researcher who...

SAP Solution Manager 7.2 Remote Command Execution Exploit

This Metasploit module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet of SAP Solution Manager SolMan running version 7.2. The vulnerability occurs due to missing authentication checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get information abou...

JVN#83042295: Yomi-Search vulnerable to cross-site scripting

Yomi-Search provided by WonderLink is a directory type search engine program. Yomi-Search contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing a website that uses Yomi-Search. Solution Consider stop using...

FreeBSD-SA-21:07.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:07.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2021-03-25 Affects:...

WordPress Thrive Headline Optimizer premium plugin <= 1.3.7.2 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Headline Optimizer premium plugin versions = 1.3.7.2. Solution Update the WordPress Thrive Headline Optimizer premium plugin to the latest available version at least 1.3.7.3...

WordPress Focusblog premium theme <= 1.97 - Unauthenticated Arbitrary File Upload and Option Deletion

Unauthenticated Arbitrary File Upload and Option Deletion discovered by WordFence in WordPress Focusblog premium theme versions = 1.97. Solution Update the WordPress Focusblog premium theme to the latest available version at least 2.0.0...

Fedora: Security Advisory for kernel (FEDORA-2021-f0181b8085)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Medius’ small IT team supports distributed workforce with Azure Active Directory

In today’s Voice of the Customer blog post, IT Manager Jacob Andersson and IT Systems Architect Fredrik Frööjd of Medius share how Azure Active Directory Azure AD has inspired employees to live by the cloud commitment the company encourages from customers and helped their small team support a...

FTAPI Cross-Site Scripting Vulnerability

FTAPI is an end-to-end encrypted file transfer and data room solution with unlimited file size. A cross-site scripting vulnerability exists in the "Background Image" upload function in the "Submit Box Template Editor" in FTAPI 4.0 - 4.10. An attacker can exploit this vulnerability by uploading an...

SAP Solution Manager Remote Code Execution (CVE-2020-6207)

A remote code execution vulnerability exists in SAP Solution Manager. The vulnerability is due to a lack of authentication in the User Experience Monitoring componant. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successful...

Fedora: Security Advisory for tracker3-miners (FEDORA-2021-303f6623fa)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition, which are used by IBM WebSphere Cast Iron Solution & App Connect Professional . These issues were disclosed as part of the IBM Java SDK updates in Oct 2020 , IBM WebSphere Cast Iron Solution & App Connect Professional have addressed th...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, which are used by IBM Cast Iron Solution & App Connect Professional . These issues were disclosed as part of the IBM Java SDK updates in January 2021, IBM Cast Iron & App Connect Professional have addressed the...

Cisco SD-WAN Solution Software Privilege Escalation (cisco-sa-vmpresc-SyzcS4kC)

According to its self-reported version, Cisco SD-WAN Solution Software is affected by a privilege escalation vulnerability due to insufficient input validation. An authenticated, local attacker can exploit this by sending a crafted request in order to gain administrative privileges. Please see th...

RHEL 7 : curl (RHSA-2021:0877)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0877 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...