The vulnerability of the /core/feeds/custom.php component of the BigTree CMS content management system allows a hacker to execute arbitrary SQL queries.

The vulnerability of the /core/feeds/custom.php component of the BigTree CMS content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2021-32942

The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions WindowViewer if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location...

Mozilla: Partial protection of inline OpenPGP message not indicated

If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird 78.10.2...

The vulnerability of the virtual learning environment Moodle, related to the lack of protection for the website structure, allows a hacker to execute arbitrary HTML code and script code in the user’s browser within the context of the vulnerable website.

The vulnerability of the virtual learning environment Moodle is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code and script code in the user’s browser, within the context of the...

The vulnerability of the Microsoft Accessibility Insights browser extension, related to the lack of data protection for service data, allows a malicious actor to gain unauthorized access to the device.

The vulnerability of the Microsoft Accessibility Insights browser extension is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the device through a specially created web page...

The vulnerability of the Microsoft Windows Infrared Data Association (IrDA) component of the Windows operating system, related to the lack of protection for service data, allows a perpetrator to disclose protected information.

The vulnerability of the Microsoft Windows Infrared Data Association IrDA component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the CSC service in the Windows operating system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CSC service in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2021-29957

If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird 78.10.2...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of measures taken to protect the website structure, allowing attackers to execute arbitrary JavaScript code.

The vulnerability of the Magento Commerce development and management software platform relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser, through access with...

Mozilla Thunderbird < 78.10.2

The version of Thunderbird installed on the remote Windows host is prior to 78.10.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-22 advisory. - If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an...

PT-2021-4215 · Texas Instruments · Ti-Rtos

Name of the Vulnerable Software and Affected Versions: Texas Instruments TI-RTOS affected versions not specified Description: The issue is related to an integer overflow vulnerability in the HeapMem allocUnprotected function. This vulnerability can be triggered when the malloc function returns a...

CVE-2020-21994

AVE DOMINAplus =1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file '/xml/authClients.xml' and obtain administrative login information that allows for a successful...

PT-2021-10709 · Unknown · Ave Dominaplus

Name of the Vulnerable Software and Affected Versions: AVE DOMINAplus versions prior to 1.11 Description: The issue allows an unauthenticated attacker to obtain administrative login information by accessing an unprotected directory that hosts an XML file '/xml/authClients.xml', enabling a...

The vulnerability of the Azure DevOps Server software development tools, related to the lack of protective measures for website structures, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Azure DevOps Server software development tools is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2021-26909

Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent...

CVE-2021-29950

Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This vulnerability affects Thunderbird 78.8.1...

The vulnerability of the Cockpit database component in Adaptive Server Enterprise, which allows a hacker to disclose protected information

The vulnerability of the Cockpit database component in Adaptive Server Enterprise is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

WordPress Redirection for Contact Form 7 plugin <= 2.3.3 - Unprotected AJAX Actions vulnerability

Unprotected AJAX Actions vulnerability discovered by WordFence in WordPress Redirection for Contact Form 7 plugin versions = 2.3.3. Solution Update the WordPress Redirection for Contact Form 7 plugin to the latest available version at least 2.3.4...

Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions

In the plugin, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to add actions to a form, and more...

The vulnerability of NETGEAR WAC720 and WAC730 wireless access points’ microprogramming software lies in the lack of protection for service data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of NETGEAR WAC720 and WAC730 wireless access points lies in the lack of protection for service data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...