CVE-2021-34261

An issue in USBHParseCfgDesc of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature...

CVE-2021-34261

An issue in USBHParseCfgDesc of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature...

STMicroelectronics STM32Cube 安全漏洞

The Stmicroelectronics STMicroelectronics STM32Cube is a microcontroller for embedded systems from STMicroelectronics Switzerland. A security vulnerability exists in USBHParseCfgDesc in STMicroelectronics STM32Cube Middleware v1.8.0 and earlier versions, which denies service due to a system hang...

CVE-2021-34631

The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handlesavestyle function found in the /news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18...

CURL-CVE-2021-22926 CURLOPT_SSLCERT mix-up with Secure Transport

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool. When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certifica...

Oracle MySQL Server 输入验证错误漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation. A denial-of-service vulnerability exists in the Server: Optimizer component of Oracle MySQL Server 8.0.25 and earlier versions. An attacker can exploit this vulnerability to cause MySQL Server to hang or...

KN Fix Your Title <= 1.0.1 - Authenticated Stored XSS

The plugin was vulnerable to Authenticated Stored XSS in the separator field. PoC 1. Install WordPress 5.7.2 2. Install and activate KN Fix Your Title 3. Navigate to Fix Title under Settings Tab Click on I have done this and enter the XSS payload into the Separator input field. 4. Click Save...

Introducing Bounty Awards for Teams Mobile Applications Security Research

We are pleased to announce the addition of Microsoft Teams mobile applications to the Microsoft Applications Bounty Program. Through the expanded program we welcome researchers from across the globe to seek out and disclose any high impact security vulnerabilities they may find in Teams mobile...

WordPress plugin code injection vulnerability (CNVD-2021-52422)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A code injection vulnerability exists in the WordPress...

SUSE: Security Advisory (SUSE-SU-2021:2303-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-59595)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. Smooth Scroll Page Up/Down Buttons WordPress plugin...

WordPress Current Book 1.0.1 Cross Site Scripting

Exploit Title: WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting XSS Date: 14/07/2021 Exploit Author: Vikas Srivastava Vendor Homepage: Software Link: https://wordpress.org/plugins/current-book/ Version: 1.0.1 Category: Web Application How to Reproduc...

Unauthorized Access Vulnerability in Midland Public Health's Mobile Follow-Up Visits

Chongqing Zhonglian Information Industry Co., Ltd. is one of the largest private high-tech enterprises specializing in the research, development and promotion of medical informatization products, and one of the largest providers of comprehensive solutions for digital hospitals in China. An...

CVE-2021-24441

The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue...

CVE-2021-24440

The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in...

CVE-2021-24440

The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in...

CVE-2021-24441

The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue...

Design/Logic Flaw

The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue...

CVE-2021-24441

CVE-2021-24441 affects the WordPress Sign-up Sheets plugin (versions prior to 1.0.14). The issue is CSV injection arising when exporting CSVs: the plugin does not sanitise or validate the Sheet title during CSV generation, allowing potentially unsafe input to be interpreted as a formula. Public s...

CVE-2021-24440

The CVE-2021-24440 issue affects the WordPress Sign-up Sheets plugin for versions before 1.0.14. The root cause is failure to sanitise/escape certain fields when creating a new sheet, enabling authenticated high-privilege users to inject JavaScript and trigger stored XSS when admins view the All ...