‼ CVE-2021-41920 ‼
📖 Read
via "National Vulnerability Database".
webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sor_cible, sor_champs, and sor_ordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain access to the webTareas application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41916 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrative profile and add a new user to the new profile. without the victim's knowledge, by enticing an authenticated admin user to visit an attacker's web page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41825 ‼
📖 Read
via "National Vulnerability Database".
Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41919 ‼
📖 Read
via "National Vulnerability Database".
webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by adding or replacing a personal profile picture. The affected endpoint is /includes/upload.php on the HTTP POST data. This allows an attacker to exploit the platform by injecting code or malware and, under certain conditions, to execute code on remote user browsers.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41917 ‼
📖 Read
via "National Vulnerability Database".
webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients section, due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the platform users and administrators. The affected endpoint is /clients/editclient.php, on the HTTP POST cn parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41566 ‼
📖 Read
via "National Vulnerability Database".
The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41976 ‼
📖 Read
via "National Vulnerability Database".
Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41563 ‼
📖 Read
via "National Vulnerability Database".
Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41568 ‼
📖 Read
via "National Vulnerability Database".
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32029 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20600 ‼
📖 Read
via "National Vulnerability Database".
Uncontrolled resource consumption in MELSEC iQ-R series C Controller Module R12CCPU-V all versions allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending a large number of packets in a short time while the module starting up.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41565 ‼
📖 Read
via "National Vulnerability Database".
TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41918 ‼
📖 Read
via "National Vulnerability Database".
webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the application because it is related on how each URL is echoed back on every response page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41567 ‼
📖 Read
via "National Vulnerability Database".
The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41974 ‼
📖 Read
via "National Vulnerability Database".
Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.📖 Read
via "National Vulnerability Database".
🦿 You can create Let's Encrypt SSL certificates with acme.sh on Linux 🦿
📖 Read
via "Tech Republic".
Let's make issuing and installing SSL certificates less of a challenge. Tools like acme.sh can help. Jack Wallen shows you how to install and use this handy script.📖 Read
via "Tech Republic".
TechRepublic
You can create Let's Encrypt SSL certificates with acme.sh on Linux
Let's make issuing and installing SSL certificates less of a challenge. Tools like acme.sh can help. Jack Wallen shows you how to install and use this handy script.
‼ CVE-2020-4654 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due to improper permission control. IBM X-Force ID: 186090.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29906 ‼
📖 Read
via "National Vulnerability Database".
IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors. IBM X-Force ID: 207630.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42109 ‼
📖 Read
via "National Vulnerability Database".
VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.📖 Read
via "National Vulnerability Database".
🕴 North American Orgs Hit With an Average of 497 Cyberattacks per Week 🕴
📖 Read
via "Dark Reading".
A new analysis confirms a surge in global cyberattacks since the COVID-19 pandemic began.📖 Read
via "Dark Reading".
Dark Reading
North American Orgs Hit With an Average of 497 Cyberattacks per Week
A new analysis confirms a surge in global cyberattacks since the COVID-19 pandemic began.
‼ CVE-2021-30632 ‼
📖 Read
via "National Vulnerability Database".
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".