‼ CVE-2021-24996 ‼
📖 Read
via "National Vulnerability Database".
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0648 ‼
📖 Read
via "National Vulnerability Database".
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0248 ‼
📖 Read
via "National Vulnerability Database".
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24575 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41952 ‼
📖 Read
via "National Vulnerability Database".
Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22734 ‼
📖 Read
via "National Vulnerability Database".
The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24574 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0702 ‼
📖 Read
via "National Vulnerability Database".
The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24577 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen ().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0327 ‼
📖 Read
via "National Vulnerability Database".
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0946 ‼
📖 Read
via "National Vulnerability Database".
Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24576 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by Use After Free through MP4Box.📖 Read
via "National Vulnerability Database".
⚠ Cryptocoin ATMs ruled illegal – “Shut down at once”, says regulator ⚠
📖 Read
via "Naked Security".
If you live in the UK and hadn't yet heard of cryptocoin ATMs... it's too late now!📖 Read
via "Naked Security".
Naked Security
Cryptocoin ATMs ruled illegal – “Shut down at once”, says regulator
If you live in the UK and hadn’t yet heard of cryptocoin ATMs… it’s too late now!
🕴 Mobile Threats Skyrocket 🕴
📖 Read
via "Dark Reading".
A new report shows an explosion of zero-day attacks and malware focused on mobile devices just as companies adopted widespread bring-your-own device policies.📖 Read
via "Dark Reading".
Dark Reading
Mobile Threats Skyrocket
A new report shows an explosion of zero-day attacks and malware focused on mobile devices just as companies adopted widespread bring-your-own device policies.
‼ CVE-2021-39051 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22346 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22353 ‼
📖 Read
via "National Vulnerability Database".
IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate permissions to obtain sensitive information by bypassing data masking rules using a CREATE TABLE SELECT statement. IBM X-Force ID: 220480.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38971 ‼
📖 Read
via "National Vulnerability Database".
IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to bypass data masking rules and obtain sensitve information. IBM X-Force ID: 212620.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22344 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 220038📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22354 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM X-Force ID: 220485.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39055 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214534.📖 Read
via "National Vulnerability Database".