943 matches found
Beers with Talos, Ep. #114: And then there were two...
Beers with Talos BWT Podcast episode No. 114 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherRecorded Dec. 9, 2021. If iTunes and Google Play aren't your thing, click here. We joked... This is only the beginning! Please vis...
WordPress Newsletter, SMTP, Email marketing and Subscribe plugin <= 3.1.30 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Newsletter, SMTP, Email marketing and Subscribe plugin versions = 3.1.30. Solution Update the WordPress Newsletter, SMTP, Email marketing and Subscribe plugin to the latest available version at least 3.1.31...
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS
The plugin does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC...
WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin <= 3.1.24 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin versions = 3.1.24. Solution Update the WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin to the latest available...
Privilege Escalation
freeswitch is vulnerable to privilege escalation. The vulnerability exists due to SIP requests of the type SUBSCRIBE are not authenticated by default...
MQTT Buffer Overflow Vulnerability
MQTT Message Queuing Telemetry Transport is a messaging protocol based on the Publish/Subscribe paradigm under the ISO standard ISO/IEC PRF 20922, which works on the TCP/IP protocol family and is designed as a publish/subscribe messaging protocol for remote devices with low hardware performance a...
CVE-2021-41157
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Abuse...
Design/Logic Flaw
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Abuse...
CVE-2021-41157
CVE-2021-41157 affects FreeSWITCH where SIP SUBSCRIBE requests are not authenticated by default in affected releases. The issue allows unauthenticated subscriptions to user agent event notifications, posing privacy risks (e.g., monitoring SIP extensions). The advisory notes a fix in v1.10.6, but ...
CVE-2021-41157 FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Abuse...
FreeSWITCH 1.10.5 SIP SUBSCRIBE Missing Authentication Exploit
FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default - Fixed versions: v1.10.7 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-08-freeswitch-SIP-SUBSCRIBE-without-auth - Vendor Security Advisory:...
FreeSWITCH 访问控制错误漏洞
FreeSWITCH is a free, open-source communications software program developed by Anthony Minessale, an individual developer in the United States. The software can be used to create audio, video, and short message products and applications. An authorization issue vulnerability exists in FreeSWITCH...
FreeSWITCH 1.10.5 SIP SUBSCRIBE Missing Authentication
FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default - Fixed versions: v1.10.7 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-08-freeswitch-SIP-SUBSCRIBE-without-auth - Vendor Security Advisory:...
Discourse Injection Vulnerability
Discourse is an open source community discussion platform that includes community, email, and chat room features. The platform includes community, email, and chat room features.An injection vulnerability exists in Discourse, which stems from a lack of validation in the user-controllable...
WordPress Podcast Subscribe Buttons plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress Podcast Subscribe Buttons plugin in versions prior to 1.4.2, which stems from a lack of checksum filtering of user-supplied data and output...
Remote code execution
Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribeurl values. This issue is patched in the latest stable, beta and tests-passed versions of...
PT-2021-23140 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions 2.7.8 and earlier Description: Discourse is an open source platform for community discussion. In affected versions, maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation i...
Discourse 注入漏洞
Discourse is an open source community discussion platform that includes community, email, and chat room features. The platform includes community, email, and chat room features.An injection vulnerability exists in Discourse, which stems from a lack of validation in the user-controllable...
