Cross-Site Request Forgery (CSRF) vulnerability in LeadSquared, Inc LeadSquared Suite plugin <=Â 0.7.4 versions.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000.
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting.
Request to LDAP is sent before user permissions are checked.
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow…
Решили собрать новую для нас аналитику — по вакансиям и откликам на Хабр Карьере. Мы рассматривали разное: популярные специализации в вакансиях, их эффективность, но самое интересное — какие вакансии на Хабр Карьере получают больше всего откликов. И мы не про конкретные предложения от компаний, а именно про начинку — о ней и будет это исследование. В общем-то, все ответы под катом. Читать далее