โผ CVE-2021-24603 โผ
๐ Read
via "National Vulnerability Database".
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24591 โผ
๐ Read
via "National Vulnerability Database".
The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24599 โผ
๐ Read
via "National Vulnerability Database".
The Email Encoder รยขรขโยฌรขโฌล Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24395 โผ
๐ Read
via "National Vulnerability Database".
The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24513 โผ
๐ Read
via "National Vulnerability Database".
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24390 โผ
๐ Read
via "National Vulnerability Database".
A proid GET parameter of the WordPressรยฆรขโฌ๏ฟฝรยฏรยครยปรลรยฅรยฎ?Alipay|รยจรยดรยขรยครยปรลรยฉรขโยฌร
ยกTenpay|รยจรยด?รยฅรยฎ?PayPalรยฉรขโฌยบรขโฌ รยฆรโ ?รยฆ?รขโฌโขรยครยปรยถ WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24392 โผ
๐ Read
via "National Vulnerability Database".
An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24393 โผ
๐ Read
via "National Vulnerability Database".
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24391 โผ
๐ Read
via "National Vulnerability Database".
An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24601 โผ
๐ Read
via "National Vulnerability Database".
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24611 โผ
๐ Read
via "National Vulnerability Database".
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24517 โผ
๐ Read
via "National Vulnerability Database".
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24568 โผ
๐ Read
via "National Vulnerability Database".
The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24435 โผ
๐ Read
via "National Vulnerability Database".
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues๐ Read
via "National Vulnerability Database".
๐ฆฟ Cybersecurity: Watch out for these unique fraudster tricks Loki would be proud of ๐ฆฟ
๐ Read
via "Tech Republic".
Online fraud is getting sneakier and stealthier as mischievous operatives evolve their techniques. Learn some of the unique tricks afoot today and how to spot them.๐ Read
via "Tech Republic".
TechRepublic
Cybersecurity: Watch out for these unique fraudster tricks Loki would be proud of
Online fraud is getting sneakier and stealthier as mischievous operatives evolve their techniques. Learn some of the unique tricks afoot today and how to spot them.
โผ CVE-2021-25735 โผ
๐ Read
via "National Vulnerability Database".
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-3768 โผ
๐ Read
via "National Vulnerability Database".
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')๐ Read
via "National Vulnerability Database".
โผ CVE-2021-32568 โผ
๐ Read
via "National Vulnerability Database".
mrdoc is vulnerable to Deserialization of Untrusted Data๐ Read
via "National Vulnerability Database".
โผ CVE-2021-3770 โผ
๐ Read
via "National Vulnerability Database".
vim is vulnerable to Heap-based Buffer Overflow๐ Read
via "National Vulnerability Database".
โผ CVE-2021-3766 โผ
๐ Read
via "National Vulnerability Database".
objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')๐ Read
via "National Vulnerability Database".
โผ CVE-2021-25737 โผ
๐ Read
via "National Vulnerability Database".
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.๐ Read
via "National Vulnerability Database".