1066 matches found
CVE-2021-24487
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a...
CVE-2021-24487
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a...
CVE-2021-24487
CVE-2021-24487 concerns the WordPress plugin St-Daily-Tip (versions ≤ 4.7). The vulnerability arises from a lack of CSRF protection and insufficient sanitisation/escaping when saving the setting “Default Text to Display if no tips,” allowing a logged-in attacker to cause a stored Cross-Site Scrip...
WordPress plugin St-Daily-Tip 跨站脚本漏洞
WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress St-Daily-Tip plugin has a cross-site request spoofing vulnerability in version 4.7 and earlier, which stems from a...
stjosephukr.com Improper Access Control vulnerability OBB-2181971
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
st-martini.net Cross Site Scripting vulnerability OBB-2180015
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
It’s Not You. It’s Them. On Hacking and Responsible Disclosure.
A story was recently posted to Hacker News celebrating a hack of IoT devices at a school that let a student and their friends rickroll the school via a video system. On the one hand, this guy is my personal hero and I want to be them. But Im a cybersecurity professional, I run a team that has the...
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability
On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov...
WordPress St-Daily-Tip plugin <= 4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Akash Rajendra Patil in WordPress St-Daily-Tip plugin versions = 4.7. Solution Deactivate and delete. This plugin has been closed as of June 28, 2021 and is not available for download. Reason:...
The vulnerability of the conference communication component of the Mitel ST 14.2 telecommunications system, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.
The vulnerability of the conference communication component in Mitel ST 14.2 telecommunications systems is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
STMicroelectronics STM32Cube Middleware 安全漏洞
The Stmicroelectronics STMicroelectronics STM32Cube is a microcontroller for embedded systems from Stmicroelectronics Switzerland. A security vulnerability exists in the STMicroelectronics STM32Cube Middleware that can be exploited by an attacker to execute arbitrary code...
STMicroelectronics STM32Cube 安全漏洞
The Stmicroelectronics STMicroelectronics STM32Cube is a microcontroller for embedded systems from STMicroelectronics Switzerland. A security vulnerability exists in the USBHMSCInterfaceInit function in STMicroelectronics STM32Cube Middleware v1.8.0 and earlier versions, which can lead to a denia...
D-Link DIR-802 Command Injection Vulnerability
The D-Link DIR-802 is a wireless router from AUO D-Link in Taiwan, China. A command injection vulnerability exists in the D-Link DIR-802 A1 1.00b05 and earlier versions, which stems from the system default of enabling Universal Plug and Play on port 1900. An attacker can exploit this vulnerabilit...
CVE-2021-3304
Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI...
CVE-2021-3304
CVE-2021-3304 affects Sagemcom F@ST 3686 v2 with firmware 3.495; a buffer overflow is triggered by a long sessionKey to the /goform/login URI. Connected documents confirm the affected product and input vector, but do not provide exploitation details or remediation steps in the supplied material.
giovanni-stpauli.digital-guest.de Cross Site Scripting vulnerability OBB-1493377
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
st-pierre-daurillac.fr Cross Site Scripting vulnerability OBB-1484580
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
giovanni-stpauli.digital-guest.de Cross Site Scripting vulnerability OBB-1382494
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
openSUSE Security Update : libmediainfo / mediainfo (openSUSE-2020-1390)
This update for libmediainfo, mediainfo fixes the following issues : libmediainfo was updated to version 20.08 : Added : - MPEG-H 3D Audio full featured support group presets, switch groups, groups, signal groups - MP4/MOV: support of more metadata locations - JSON and XML outputs: authorize...
kirche-st-gabriel.de Cross Site Scripting vulnerability OBB-1348791
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...