W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

The plugin was affected by a reflected Cross-Site Scripting XSS issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This...

WordPress W3 Total Cache plugin <= 2.1.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by renniepak in WordPress W3 Total Cache plugin versions = 2.1.4. Solution Update the WordPress W3 Total Cache plugin to the latest available version at least 2.1.5...

WordPress W3 Total Cache plugin <= 2.1.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by renniepak in WordPress W3 Total Cache plugin versions = 2.1.3. Solution Update the WordPress W3 Total Cache plugin to the latest available version at least 2.1.4...

W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)

The plugin was vulnerable to a reflected Cross-Site Scripting XSS security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a...

The vulnerability of the McAfee Total Protection download client allows a hacker to execute arbitrary code.

The vulnerability of the McAfee Total Protection antivirus protection software’s download process is related to the use of an unreliable search path during the download of dynamic DLL libraries. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2020-15732

Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially bypass HTTP Strict Transport Security HSTS checks. This issue affects: Bitdefender Total Security versions prior to 25.0.7.29. Bitdefender...

CVE-2020-15732

CVE-2020-15732 is an improper certificate validation vulnerability in the Online Threat Prevention module used by several Bitdefender products (Total Security, Internet Security, Antivirus Plus). The issue potentially allows bypassing HTTP Strict Transport Security (HSTS) checks. Affected version...

CVE-2020-15732

Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially bypass HTTP Strict Transport Security HSTS checks. This issue affects: Bitdefender Total Security versions prior to 25.0.7.29. Bitdefender...

Bitdefender 多款产品信任管理问题漏洞

Bitdefender Antivirus Plus is a suite of antivirus software that provides network threat detection and ransomware protection.Bitdefender Internet Security is a suite of antivirus software that focuses on Internet security. Bitdefender Antivirus Plus is a suite of antivirus programs that provides...

Semrush: Improper input validation in projects leads to fully deny access to project resources

INTRODUCTION Accounts used to search for this vulnerability: - id: █████████ email:███ - id: █████████ email: █████████ Most of the requests made to test the vulnerability were made with the "X-hackerone: adam" header IP used: ████ / ███ Endpoint URL:...

Unified Office Total Connect Now 1.0 - (data) SQL Injection Vulnerability

Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection Shodan Filter: http.title:"TCN User Dashboard" Exploit Author: Ajaikumar Nadar Vendor Homepage: https://unifiedoffice.com/ Software Link: https://unifiedoffice.com/voip-business-solutions/ Version: 1.0 Tested on: CentOS +...

Unified Office Total Connect Now 1.0 SQL Injection

Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection Shodan Filter: http.title:"TCN User Dashboard" Date: 06-16-2021 Exploit Author: Ajaikumar Nadar Vendor Homepage: https://unifiedoffice.com/ Software Link: https://unifiedoffice.com/voip-business-solutions/ Version: 1.0...

Unified Office Total Connect Now 1.0 - 'data' SQL Injection

Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection Shodan Filter: http.title:"TCN User Dashboard" Date: 06-16-2021 Exploit Author: Ajaikumar Nadar Vendor Homepage: https://unifiedoffice.com/ Software Link: https://unifiedoffice.com/voip-business-solutions/ Version: 1.0...

W3 Total Cache < 2.1.3 - Authenticated Stored XSS

The plugin did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue PoC Vulnerable parameters: cnames= 1, cdncnames= 2, cdncnames= 3. CDN Type:...

Is It Time to Consider Replacing Your CDN?

Content delivery networks CDNs are the pipelines of the Internet. Working behind the scenes, they are reshaping how information is consumed online, accelerating web traffic, enhancing user experience, and providing every website with the ability to truly go global. As you may imagine, any...

McAfee Total Protection Elevation of Privilege Vulnerability

McAfee Total Protection MTP is a one-stop security suite. An elevation of privilege vulnerability exists in McAfee Total Protection prior to version 16.0.32. An attacker could exploit this vulnerability to elevate privileges by emulating a client token...

McAfee Total Protection Elevation of Privilege Vulnerability (CNVD-2021-38090)

McAfee Total Protection MTP is a one-stop security suite. An elevation of privilege vulnerability exists in the File Lock component of McAfee Total Protection prior to version 16.0.32. An attacker could use this vulnerability to elevate privileges by manipulating symbolic links in the IOCTL...

CVE-2021-23891

Privilege Escalation vulnerability in McAfee Total Protection MTP prior to 16.0.32 allows a local user to gain elevated privileges by impersonating a client token which could lead to the bypassing of MTP self-defense...

CVE-2021-23872

Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection MTP prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface...

CVE-2021-23891

Privilege Escalation vulnerability in McAfee Total Protection MTP prior to 16.0.32 allows a local user to gain elevated privileges by impersonating a client token which could lead to the bypassing of MTP self-defense...