CVE-2021-38327

The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0...

WordPress plugin cross-site scripting vulnerabilities

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin WP Scrippets 1.5.1 and earlier versions, which stems from a lack of valid validation and escaping of the $SERVER"PHPSELEF" value in /wp-scrippets. An attacker...

CVE-2021-38319

The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /morefromgoogle.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2...

GHSA-JF9V-Q8VH-3FMC Cross-site scripting in ICEcoder

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the GET'replace' variable. As a result, arbitrary Javascript code can get executed...

CVE-2021-38540

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

PYSEC-2021-326

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

CVE-2021-38540

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

PYSEC-2021-326

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

CVE-2021-30295

Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables...

CVE-2021-30295

Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables...

CVE-2021-31274: Improper Neutralization of Input During Web Page Generation

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

CVE-2020-19766: Improper Check for Unusual or Exceptional Conditions

The time check operation of PepeAuctionSale 1.0 can be rendered ineffective by assigning a large number to the duration variable, compromising access control to the application...

PT-2021-10407

Name of the Vulnerable Software and Affected Versions: PepeAuctionSale version 1.0 Description: The time check operation can be compromised by assigning a large number to the duration variable, which renders access control to the application ineffective. Recommendations: For PepeAuctionSale versi...

PepeAuctionSale code-related vulnerabilities

PepeAuctionSale is a DeFi aggregator on Etherscan. An access control error vulnerability exists in PepeAuctionSale, which stems from the fact that the time check operation in PepeAuctionSale 1.0 can be made invalid by assigning a large number to the duration variable, thus affecting access to the...

CVE-2021-39322

The Easy Social Icons plugin = 3.0.8 for WordPress echoes out the raw value of $SERVER'PHPSELF' in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path...

CVE-2021-35995 Adobe After Effects MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability

Adobe After Effects version 18.2.1 and earlier is affected by an Improper input validation vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation o...

CVE-2021-35995 Adobe After Effects MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability

Adobe After Effects version 18.2.1 and earlier is affected by an Improper input validation vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation o...

GHSA-WCG3-CVX6-7396 Segmentation fault in time

Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library. The...

CVE-2021-30913: Undefined Security Weakness

The issue was addressed with improved permissions logic. This issue is fixed in macOS Monterey 12.0.1, macOS Big Sur 11.6.1. An unprivileged application may be able to edit NVRAM variables...

Uninitialized Variable marketWhitelist in RCTreasury.sol

Handle leastwood Vulnerability details Impact The variable, marketWhitelist, is never initialized in the contract RCTreasury.sol. As a result, the function marketWhitelistCheck does not perform a proper check on whitelisted users for a restricted market. Additionally, the function will always...