Security
Headlines
HeadlinesLatestCVEs

Tag

#apple

CVE-2021-41930: CVE-nu11secur1ty/vendors/oretnom23/CVE-nu11-18-09-2821 at main · nu11secur1ty/CVE-nu11secur1ty

Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, allows attackers to execute arbitrary code via the lid parameter to /scheduler/addSchedule.php.

CVE
#sql#xss#vulnerability#web#windows#apple#apache#git
CVE-2021-44244: CVE-nu11secur1ty/vendors/oretnom23/Simple-Logistic-Hub-Parcels-Management at main · nu11secur1ty/CVE-nu11secur1ty

An SQL Injection vulnerabiity exists in Sourcecodester Logistic Hub Parcel's Management System 1.0 via the username parameter in login.php.

CVE-2021-46026: There is a stored xss vulnerability exists in mysiteforme · Issue #39 · wangl1989/mysiteforme

mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.

CVE-2021-46028: There is a CSRF vulnerability exists in mblog<=3.5.0 · Issue #50 · langhsu/mblog

In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.

CVE-2021-46027: There is a CSRF vulnerability exists in mysiteforme · Issue #40 · wangl1989/mysiteforme

mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added

CVE-2021-46025: There is a stored xss vulnerability exists in OneBlog- <=2.2.8 · Issue #27 · zhangyd-c/OneBlog

A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background.

CVE-2022-21363: Oracle Critical Patch Update Advisory - January 2022

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2022-21403: Oracle Critical Patch Update Advisory - January 2022

Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. While the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Operations Monitor. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:...

CVE-2022-23408: wolfssl/ChangeLog.md at master · wolfSSL/wolfssl

wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c.

CVE-2021-39892: Import pending members from public projects or private projects (if you have guest role) (#28440) · Issues · GitLab.org / GitLab

In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users.