โผ CVE-2021-24608 โผ
๐ Read
via "National Vulnerability Database".
The Formidable Form Builder รยขรขโยฌรขโฌล Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24489 โผ
๐ Read
via "National Vulnerability Database".
The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24884 โผ
๐ Read
via "National Vulnerability Database".
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0939 โผ
๐ Read
via "National Vulnerability Database".
In set_default_passthru_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186026549References: N/A๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0410 โผ
๐ Read
via "National Vulnerability Database".
In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561360; Issue ID: ALPS05561360.๐ Read
via "National Vulnerability Database".
โผ CVE-2020-7859 โผ
๐ Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.๐ Read
via "National Vulnerability Database".
โผ CVE-2020-14264 โผ
๐ Read
via "National Vulnerability Database".
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0414 โผ
๐ Read
via "National Vulnerability Database".
In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561384; Issue ID: ALPS05561384.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0633 โผ
๐ Read
via "National Vulnerability Database".
In display driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05585423; Issue ID: ALPS05585423.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0409 โผ
๐ Read
via "National Vulnerability Database".
In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561359; Issue ID: ALPS05561359.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0935 โผ
๐ Read
via "National Vulnerability Database".
In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References: Upstream kernel๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24544 โผ
๐ Read
via "National Vulnerability Database".
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24779 โผ
๐ Read
via "National Vulnerability Database".
The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any capability and CSRF checks, as a result, the settings can be updated by unauthenticated users.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0634 โผ
๐ Read
via "National Vulnerability Database".
In display driver, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594994; Issue ID: ALPS05594994.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0625 โผ
๐ Read
via "National Vulnerability Database".
In ccu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594996; Issue ID: ALPS05594996.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0613 โผ
๐ Read
via "National Vulnerability Database".
In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05489178.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-41035 โผ
๐ Read
via "National Vulnerability Database".
In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-24514 โผ
๐ Read
via "National Vulnerability Database".
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed๐ Read
via "National Vulnerability Database".
๐๏ธ Popular NPM package UA-Parser-JS poisoned with cryptomining, password-stealing malware ๐๏ธ
๐ Read
via "The Daily Swig".
Developer moves quickly to address vulnerabilities after his account was compromised๐ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Popular NPM package UA-Parser-JS poisoned with cryptomining, password-stealing malware
Developer moves quickly to address vulnerabilities after his account was compromised
โผ CVE-2021-24699 โผ
๐ Read
via "National Vulnerability Database".
The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.๐ Read
via "National Vulnerability Database".
โผ CVE-2021-0663 โผ
๐ Read
via "National Vulnerability Database".
In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05844458; Issue ID: ALPS05844458.๐ Read
via "National Vulnerability Database".