CVE-2021-39351 WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection

The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the /Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2...

CVE-2021-20372

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permission checking. IBM X-Force ID: 195518...

CVE-2021-20571

IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

IBM Sterling File Gateway 信息泄露漏洞

IBM Sterling File Gateway is an application for transferring files between internal and external partners, allowing you to more securely and reliably transfer files with trading partners.An information disclosure vulnerability exists in IBM Sterling File Gateway version 6.0.1.0-6.1.0.2. An attack...

UBUNTU-CVE-2021-39886

Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references...

CVE-2021-29798

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 203734...

CVE-2021-29758

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to perform actions that they should not be able to access due to improper access controls. IBM X-Force ID: 202169...

PT-2021-16888 · Unknown · Calibre-Web

Name of the Vulnerable Software and Affected Versions: Calibre-web versions 0.6.0 through 0.6.12 Description: The issue concerns a Stored XSS in the "Metadata" of the Calibre-web application. An attacker with access to edit metadata information can inject a JavaScript payload in the description...

GitLab EE 跨站脚本漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab EE...

PT-2021-15530 · Unknown · Handsontable

Name of the Vulnerable Software and Affected Versions: handsontable versions 0 through 10.0.0 excluding 10.0.0 Description: The issue concerns a Regular Expression Denial of Service ReDoS in the Handsontable.helper.isNumeric function. This affects the handsontable package, making it vulnerable to...

Shuup 注入漏洞

Shuup is an open source e-commerce platform based on Django and Python from Shuup, Inc. Shuup suffers from an injection vulnerability that stems from a formula injection vulnerability affecting Shuup applications in versions 0.4.2 through 2.10.8. A customer can inject a payload into the name inpu...

CVE-2021-22946

A user can tell curl = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server --ssl-reqd on the command line orCURLOPTUSESSL set to CURLUSESSLCONTROL or CURLUSESSLALL withlibcurl. This requirement could be bypassed if the server would return a...

PT-2021-11026 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.3.2 through 2.6 Description: A Server Side Request Forgery SSRF issue exists via the email function. When writing an email in an editor, it is possible to upload pictures from remote websites. Recommendations: For version...

Underscore.js 1.3.2 < 1.12.1 Arbitrary Code Injection

According to its self-reported version number, Underscore.js is 1.3.2 prior to 1.12.1 or 1.13.x prior to 1.13.0-2. Therefore, it may be affected by an arbitrary code injection via the template function when the variable option is taken from .templateSettings. Note that the scanner has not tested...

Tremor 资源管理错误漏洞

Tremor is an open source event processing system for unstructured data. A resource management error vulnerability exists in Tremor Tremor-runtime, which arises when the product causes access to freed memory when using patch or merge on a state and assigning the result back to the state state. The...

ALPINE-CVE-2021-36160

A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash DoS. This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 inclusive...

CVE-2021-36160

A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash DoS. This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 inclusive...

Apache HTTP Server 缓冲区错误漏洞

Apache HTTP Server is an open source web server from the Apache Foundation. Apache HTTP Server versions 2.4.30 to 2.4.48 contain a denial-of-service vulnerability that stems from a network system or product that does not properly validate incoming data. An attacker could exploit this vulnerabilit...

CVE-2021-39126

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery CSRF vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions a...

AZL-45225 CVE-2021-23440 affecting package js-jquery 3.5.0-4

This affects the package set-value before =3.0.0 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays...