CVE-2021-41565

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks...

CVE-2021-41564

Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in...

Authorization

Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in...

CVE-2021-41567

The CVE-2021-41567 entry describes stored XSS in Tad Uploader’s view book list function, caused by insufficient filtering of the add subject parameter. Unauthenticated attackers can remotely inject JavaScript and execute client-side code. This vulnerability is corroborated by multiple connected r...

CVE-2021-41565

CVE-2021-41565 affects Tad Tools TadTools. The issue is a cross-site scripting vulnerability caused by insufficient validation of input on a special page parameter, enabling remote attackers to inject JavaScript without logging in and potentially perform reflective XSS. Primary impact is client-s...

Zoho ManageEngine Remote Access Plus Trust Management Issue Vulnerability (CNVD-2022-09266)

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A trust management issue vulnerability previously existed in Zoho ManageEngine Remote Access Plus 10.1.2121.1, which stems from the fact that the affected product has hard-coded credentials for read-only The...

ECOA BAS controller information disclosure vulnerability (CNVD-2021-83644)

ECOA BAS controller is a smart lighting control solution. ECOA BAS controller is vulnerable to information disclosure, which can be exploited by remote attackers to submit special requests that can obtain sensitive information...

Zoho ManageEngine Remote Access Plus Trust Management Issue Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A trust management issue vulnerability previously existed in Zoho ManageEngine Remote Access Plus 10.1.2121.1, which stems from the fact that the affected product has hard-coded credentials associated with resetPWD.x...

What special needs kids need to stay safe online

Online safety is hard enough for most adults. We reuse weak passwords, we click on suspicious links, and we love to share sensitive information that should be kept private and secure. Just go back a few months to watch adults gleefully sharing photos of their vaccine cards. The consequences of...

CVE-2021-38394 Missing Protection against Hardware Reverse Engineering Using Integrated Circuit Imaging Techniques for Boston Scientific Zoom Latitude

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted...

Cross-site Scripting (XSS)

mediawiki/core is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the $date variable in the render function of FullSearchResultWidget.php as it does not properly escape the month-related MediaWiki messages before being used on the Special: Searc...

PT-2021-23411 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.36.2 Description: The issue allows for XSS due to month-related MediaWiki messages not being escaped before being used on the Special:Search results page. Recommendations: For versions prior to 1.36.2, update to...

CVE-2021-38394

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted...

Multiple NETGEAR Device Command Injection Vulnerabilities (CNVD-2021-83557)

Netgear NETGEAR is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks. Several NETGEAR devices have a security vulnerability that stems from the product's failure to filter special characters in user input data, which could allo...

Ecoa Bas controller 安全漏洞

ECOA BAS controller is a smart lighting control solution. ECOA BAS controller is vulnerable to information disclosure, which can be exploited by remote attackers to submit special requests that can obtain sensitive information...

Teaching cybersecurity skills to special needs children with Alana Robinson: Lock and Code S02E18

School is fully back in session for kids all across the world, and for many students, that means logging back online to learn, do homework, submit assignments, and maybe even continue some distance learning, depending on their schools pandemic precautions. But with more Internet activity comes...

in kcal-app/kcal

Description Weak password implementation Proof of Concept step 1: login into account goto http://demo.kcal.cooking/users/kcal/edit step 2: change password kcal to 12 and save changes step 3: we can see updated message application is allowing to set weak password. poc of image in below link...

Improper Input Validation and Command Injection in Ansible

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...

The vulnerability of the CLI component of the Cisco IOS XR operating system, allowing a hacker to execute arbitrary commands

The vulnerability of the CLI component of the Cisco IOS XR operating system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

The vulnerability of the CLI component of the Cisco IOS XR operating system, allowing a hacker to execute arbitrary commands

The vulnerability of the CLI component of the Cisco IOS XR operating system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...