โผ CVE-2020-26565 โผ
๐ Read
via "National Vulnerability Database".
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.๐ Read
via "National Vulnerability Database".
โผ CVE-2020-26806 โผ
๐ Read
via "National Vulnerability Database".
admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-32066 โผ
๐ Read
via "National Vulnerability Database".
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."๐ Read
via "National Vulnerability Database".
โผ CVE-2021-3351 โผ
๐ Read
via "National Vulnerability Database".
OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-34556 โผ
๐ Read
via "National Vulnerability Database".
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.๐ Read
via "National Vulnerability Database".
๐ฆฟ PwnedPiper threatens thousands of hospitals worldwide, patch your systems now ๐ฆฟ
๐ Read
via "Tech Republic".
Nine critical vulnerabilities in a popular hospital pneumatic tube software could give attackers control of infrastructure and allow them to launch additional attacks that cripple healthcare operations.๐ Read
via "Tech Republic".
TechRepublic
PwnedPiper threatens thousands of hospitals worldwide, patch your systems now
Nine critical vulnerabilities in a popular hospital pneumatic tube software could give attackers control of infrastructure and allow them to launch additional attacks that cripple healthcare operations.
โผ CVE-2021-24484 โผ
๐ Read
via "National Vulnerability Database".
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24460 โผ
๐ Read
via "National Vulnerability Database".
The get_fb_likeboxes() function in the Popup Like box รยขรขโยฌรขโฌล Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24498 โผ
๐ Read
via "National Vulnerability Database".
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24461 โผ
๐ Read
via "National Vulnerability Database".
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24481 โผ
๐ Read
via "National Vulnerability Database".
The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24472 โผ
๐ Read
via "National Vulnerability Database".
The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24450 โผ
๐ Read
via "National Vulnerability Database".
The User Registration, User Profiles, Login & Membership รยขรขโยฌรขโฌล ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24496 โผ
๐ Read
via "National Vulnerability Database".
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator๐ Read
via "National Vulnerability Database".
โผ CVE-2021-34575 โผ
๐ Read
via "National Vulnerability Database".
In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24492 โผ
๐ Read
via "National Vulnerability Database".
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-33526 โผ
๐ Read
via "National Vulnerability Database".
In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24458 โผ
๐ Read
via "National Vulnerability Database".
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24430 โผ
๐ Read
via "National Vulnerability Database".
The Speed Booster Pack รยขร
ยกรยก PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24428 โผ
๐ Read
via "National Vulnerability Database".
The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24503 โผ
๐ Read
via "National Vulnerability Database".
The Popular Brand Icons รยขรขโยฌรขโฌล Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.๐ Read
via "National Vulnerability Database".