PT-2021-16216

Name of the Vulnerable Software and Affected Versions Video Lessons Manager WordPress plugin versions prior to 1.7.2 Video Lessons Manager Pro WordPress plugin versions prior to 3.5.9 Description The issue concerns the improper sanitization and escaping of values when updating settings, potential...

CVE-2021-40889

CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in webroot/uno/central.php file calls to fileputcontents function to write username in password.php file when a user successfully changed their password. The attacker can inject malicious PHP code into...

CVE-2021-40889

CMSUno 1.7.2 is affected by a PHP code execution vulnerability. The sauvePass action in {webroot}/uno/central.php writes the username to password.php via file_put_contents() after a password change, allowing an attacker to inject PHP code into password.php and trigger code execution through login...

CMSUno 代码注入漏洞

CMSUno is a tool for creating single-page responsive websites from the French individual developer Jacques Malgrange. A security vulnerability exists in CMSUno version 1.7.2, which stems from the software being affected by a PHP code execution vulnerability. When a user successfully changes their...

CVE-2021-3747

The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner...

CVE-2021-38329

The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin DJ EmailPublish suffers from a cross-site scripting vulnerability that stems from the fact that version 1.7.2 of the DJ EmailPublish WordPress plugin is susceptible to reflected cross-site scripting attacks...

CVE-2021-24590

The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options...

CVE-2021-27491

Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed mylife Cloud discloses password hashes during the registration process...

Design/Logic Flaw

Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint...

Vault Renewed Nearly-Expired Leases With Incorrect Non-Expiring TTLs

Summary Vault and Vault Enterprise “Vault” allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. This vulnerability, CVE-2021-32923,...

WordPress插件 跨站脚本漏洞

Patreon is a subscription-based crowdfunding platform and Patreon WordPress is a WordPress plugin for the platform. A cross-site scripting vulnerability exists in Patreon WordPress versions prior to 1.7.2. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via the...

WordPress WP Super Cache Plugin < 1.7.2 RCE Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-21302 CSV Injection via csv export

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2...

Hedgedoc 跨站脚本漏洞

Hedgedoc is a Javascript-based Markdown document real-time editing and sharing platform by the Hedgedoc team. A cross-site scripting vulnerability exists in versions prior to HedgeDoc 1.7.2, which can be exploited by attackers to inject arbitrary JavaScript...

ZZZCMS zzzphp 注入漏洞

zzphp is an open source free website building system. An Eval injection vulnerability exists in the parserCommom method of the ParserTemplate class in zzzztemplate.php in zzzphp 1.7.2. A remote attacker can exploit this vulnerability to execute arbitrary commands...

GHSA-C3X7-GJMX-R2FF Open Redirect in serve-static

Versions of serve-static prior to 1.6.5 or 1.7.x prior to 1.7.2 are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory. Proof of Concept A link to http://example.com//www.google.com/%2e%2e will redirect to //www.google.com/%2e%2e Some browse...

CVE-2020-8913

A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a...

CVE-2020-8913

A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a...

Hotaru CMS Cross-Site Scripting Vulnerability

Hotaru CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in Hotaru CMS v1.7.2. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability to...