CVE-2022-1790

The CVE-2022-1790 entry concerns the WordPress plugin “New User Email Set Up” (versions

PT-2022-14083

Name of the Vulnerable Software and Affected Versions WPMK Ajax Finder WordPress plugin versions up to and including 1.0.1 Description The issue is related to Cross-Site Request Forgery, which occurs due to a missing nonce check in the createplugin atf admin setting page function found in the...

CVE-2021-41754

dynamicMarkt = 3.10 is affected by SQL injection in the parent parameter of index.php...

PT-2022-8292 · Wolfcms · Wolf Cms

Name of the Vulnerable Software and Affected Versions: WolfCMS versions up to 0.8.3.1 Description: A vulnerability was found in WolfCMS that affects the processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the name argument leads to basic cross site...

CVE-2022-29453

Cross-Site Request Forgery CSRF vulnerability in API KEY for Google Maps plugin = 1.2.1 at WordPress leading to Google Maps API key update...

HUAWEI HarmonyOS has an unspecified vulnerability (CNVD-2022-66176)

HUAWEI HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. A security vulnerability exists in HUAWEI HarmonyOS 2.0, which stems from a post-lock pop-up box issue in the operator's custom USSD service, and could be exploited by an...

Bypass filter - Stored XSS in Resources

Description Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Proof of concept javaSCRIPTalertorigin Steps to reproduce it works on Firefox not in chromium based browsers 1.Go to...

PT-2022-20474

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to and including 2.12.1 Description PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. A stack buffer...

HUAWEI HarmonyOS 安全漏洞

HUAWEI HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. A security vulnerability exists in HUAWEI HarmonyOS 2.0, which stems from a post-lock pop-up box issue in the operator's custom USSD service, and could be exploited by an...

Stored XSS in Resources

Description Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Steps to reproduce it works on Firefox not in chromium based browsers 1.Go to https://www.rosariosis.org/demonstration/ and login with...

Ascensio System ONLYOFFICE Document Server 缓冲区错误漏洞

Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets, presentations and more. A security vulnerability exists in Ascensio System ONLYOFFICE Document Server version v6.0.0 and...

CVE-2021-27781

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie...

Code injection

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie...

CVE-2021-27781 HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie...

CVE-2021-27781

CVE-2021-27781 affects HCL Technologies BigFix Mobile/Modern Client Management (1.x and 2.0). The issue is a stored cross-site scripting vulnerability that allows embedding a script tag in HTML to trigger an alert pop-up displaying a cookie. Descriptions across multiple sources label this as a st...

CVE-2022-29442

Authenticated subscriber or higher user role Stored Cross-Site Scripting XSS vulnerability in Messages For WordPress = 2.1.10 at WordPress...

PT-2022-18106 · Dell · Dell Openmanage Enterprise

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Enterprise versions 3.8.3 and prior Description: The issue is related to an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass...

GHSA-VCR8-H8QP-QJ8H Cross-Site Request Forgery in Jenkins

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user...

Chicago students lose data to ransomware attackers

Chicago Public Schools CPS disclosed on Friday that students may have had their data taken in a ransomware incident involving one of its vendors. The ransomware attack happened last December at Battelle for Kids BfK, based in Columbus Ohio, which develops services to provide innovation in schools...

New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack document.getElementById"test".submit;...