3669 matches found
CVE-2021-38590: Incorrect Permission Assignment for Critical Resource
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure SEC-584...
CVE-2021-24509
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvcstats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the...
CVE-2021-24509
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvcstats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the...
PT-2021-16031
Name of the Vulnerable Software and Affected Versions Page View Count WordPress plugin versions prior to 2.4.9 Description The issue allows users with a role as low as Contributor to perform Stored XSS attacks due to the lack of escaping of the postid parameter in the pvc stats shortcode. For...
Halve the size of images by optimising for high density displays
A long time ago we had monitors of varying resolutions, but once we started to go beyond 1024x768, screens started to get bigger as resolution got bigger. Then full-colour web-capable mobile phones arrived, but the story was the same. They had small screens, but also small resolutions. Then in 20...
Virtuozzo Automator 7.0 Update 2 Hotfix 12 (VA MN: 7.0.2-670, VA Agent: 7.0.2-398)
Hotfix 12 for Virtuozzo Automator 7.0.2 provides a new feature as well as stability and usability fixes. Vulnerability id: PVA-37513 Changing VM's OS distribution via API calls could reset the 'cpulimit' and 'iolimit' values. Vulnerability id: PVA-37526 Backup configuration was not respected by...
CVE-2021-25645
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @nsserver, leaks credentials in cleartext in the cbcollectinfo.log, debug.log, nscouchdb.log, indexer.log, and stats.log files. NOTE:...
Design/Logic Flaw
On Juniper Networks SRX Series devices with link aggregation lag configured, executing any operation that fetches Aggregated Ethernet AE interface statistics, including but not limited to SNMP GET requests, causes a slow kernel memory leak. If all the available memory is consumed, the traffic wil...
Missing permission check in cloud-stats
cloud-stats 0.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages. cloud-stats 0.27 requires Overall/Administer permission to access...
CVE-2021-22889
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the statsBreakdown parameter of stats.php and possibly other scripts due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking...
openSUSE Security Update : podman (openSUSE-2020-2039)
This update for podman fixes the following issues : Security issue fixed : - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API bsc1176804. Non-security issues fixed : - add dependency to timezone package or podman...
CVE-2020-15004
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
CVE-2020-15004
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
Cross site scripting
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
CVE-2020-15004: Improper Neutralization of Input During Web Page Generation
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS...
PT-2020-14113
Name of the Vulnerable Software and Affected Versions OX App Suite versions prior to 7.10.4 Description The issue allows for XSS in the stats/diagnostic endpoint, specifically when the param variable is used. This could potentially lead to malicious script execution. Recommendations For OX App...
Remote Code Execution (RCE)
git-stats is vulnerable to remote code execution RCE. The vulnerability exists through the unsanitized values of options.start and options.end used in an exec call in GitStats.prototype.authors...
albany.stats.pointstreak.com Cross Site Scripting vulnerability OBB-1385117
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Security update for grafana (moderate)
openSUSE Security Update: Security update for grafana Announcement ID: openSUSE-SU-2020:1611-1 Rating: moderate References: 1044444 1044933 1115960 1170557 Cross-References: CVE-2018-19039 CVE-2019-15043 CVE-2020-12245 CVE-2020-13379 Affected Products: openSUSE Backports SLE-15-SP1 An update that...
kernel: memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c allows DoS
A flaw was found in the Linux kernel. The Wireless configuration API functionality mishandles resource cleanup in nl80211getftmresponderstats function. An attacker able to trigger the resource cleanup code path could use this flaw to crash the system. The highest threat from this vulnerability is...