CVE-2021-36875

Cross-site Scripting XSS vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings WordPress plugin – uListing: from n/a through 2.0.5...

PYSEC-2021-352

furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client...

mysql: Server: DDL unspecified vulnerability (CPU Jul 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

A guide to combatting human-operated ransomware: Part 1

This blog is part one of a two-part series focused on how Microsoft DART helps customers with human-operated ransomware. For more guidance on human-operated ransomware and how to defend against these extortion-based attacks, refer to our human-operated ransomware docs page. Microsoft’s Detection...

Sela 缓冲区错误漏洞

SELA is a lossless audio codec. a heap buffer overflow vulnerability exists in file::WavFile::writeToFile in wavfile.c in SELA 20200412 and earlier versions. No detailed vulnerability details are currently available...

kubernetes input validation error vulnerability

Kubernetes is an open source Docker container cluster management system from the American Linux Foundation. The system provides resource scheduling, deployment operations, service discovery, and scale-up and scale-down for containerized applications. kubernetes has a security vulnerability that c...

Schneider Electric 多款产品授权问题漏洞

Schneider Electric C-Bus Toolkit is an application from Schneider Electric, France. It is used to run, configure and debug C-Bus installations on personal computers. An authorization issue vulnerability exists in several Schneider Electric products, which could allow remote code execution when a...

CVE-2021-38338

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

CVE-2021-38330

The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4...

CVE-2021-38353 Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...

CVE-2021-38351 OSD Subscribe <= 1.2.3 Reflected Cross-Site Scripting

The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osdsubscribemessage parameter found in the /options/osdsubscribeoptionssubscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3...

CVE-2021-27662

The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01...

The vulnerability of the clone-master-clean-up.sh utility in the SUSE Linux Enterprise Server operating system allows a hacker to delete any files they desire.

The vulnerability of the clone-master-clean-up.sh utility in the SUSE Linux Enterprise Server operating system is related to errors in link handling. Exploiting this vulnerability could allow a malicious actor to delete any files remotely...

CVE-2021-38325

The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...

CVE-2021-38324

The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the /user/shortcodes.php file which allows attackers to retrieve information contained in a site's database, in versions up to and including 1.5.3...

CVE-2021-38323 RentPress <= 6.6.4 Reflected Cross-Site Scripting

The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the /src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.6.4...

Patient Appointment Scheduler System 1.0 - Persistent / Stored XSS Exploit

Exploit Title: Patient Appointment Scheduler System 1.0 - Persistent/Stored XSS Exploit Author: a-rey Vendor Homepage: https://www.sourcecodester.com/php/14928/patient-appointment-scheduler-system-using-php-free-source-code.html Software Link: https://www.sourcecodester.com/download-code?nid=1492...

WordPress Duplicate Page 4.4.1 Cross Site Scripting

Exploit Title: WordPress Plugin Duplicate Page 4.4.1 - Stored Cross-Site Scripting XSS Date: 02/09/2021 Exploit Author: Nikhil Kapoor Software Link: https://wordpress.org/plugins/duplicate-page/ Version: 4.4.1 Category: Web Application Tested on Windows How to Reproduce this Vulnerability: 1...

CVE-2021-33055

Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...

Simiki 跨站脚本漏洞

Github Simiki is a simple wiki framework written in Python. A security vulnerability exists in Simiki v1.6.2.1 and earlier versions, which can be exploited to execute arbitrary code via line 54 of the component "Simiki/blob/master/Simiki/generators.py"...