๐Ÿ›ก Cybersecurity & Privacy ๐Ÿ›ก - News
25.8K subscribers
89.2K links
๐Ÿ—ž The finest daily news on cybersecurity and privacy.

๐Ÿ”” Daily releases.

๐Ÿ’ป Is your online life secure?

๐Ÿ“ฉ lalilolalo.dev@gmail.com
Download Telegram
โ€ผ CVE-2020-26565 โ€ผ

ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2020-26806 โ€ผ

admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-32066 โ€ผ

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-3351 โ€ผ

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-34556 โ€ผ

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿฆฟ PwnedPiper threatens thousands of hospitals worldwide, patch your systems now ๐Ÿฆฟ

Nine critical vulnerabilities in a popular hospital pneumatic tube software could give attackers control of infrastructure and allow them to launch additional attacks that cripple healthcare operations.

๐Ÿ“– Read

via "Tech Republic".
โ€ผ CVE-2021-24484 โ€ผ

The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24460 โ€ผ

The get_fb_likeboxes() function in the Popup Like box รƒยขรขโ€šยฌรขโ‚ฌล“ Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24498 โ€ผ

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24461 โ€ผ

The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24481 โ€ผ

The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24472 โ€ผ

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24450 โ€ผ

The User Registration, User Profiles, Login & Membership รƒยขรขโ€šยฌรขโ‚ฌล“ ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24496 โ€ผ

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-34575 โ€ผ

In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24492 โ€ผ

The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-33526 โ€ผ

In MB connect line mbDIALUP versions <= 3.9R0.0 a low privileged local attacker can send a command to the service running with NT AUTHORITY\SYSTEM instructing it to execute a malicous OpenVPN configuration resulting in arbitrary code execution with the privileges of the service.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24458 โ€ผ

The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24430 โ€ผ

The Speed Booster Pack รƒยขร…ยกร‚ยก PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24428 โ€ผ

The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-24503 โ€ผ

The Popular Brand Icons รƒยขรขโ€šยฌรขโ‚ฌล“ Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.

๐Ÿ“– Read

via "National Vulnerability Database".