The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability..
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin
A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to data confidentiality.
A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics (SVG) file this flaw may lead to an unauthorized memory access. The highest threat from this vulnerability is to data confidentiality and the application availability.
Нашему мобильному шутеру Pixel Gun 3D уже 9 лет. За это время у проекта появилось немало блогеров, в основном, ютуберов. Некоторые становились популярными и могли влиять на мнение игроков, с ними мы время от времени выходили на связь, но регулярной работы не было.Поэтому год назад…
Во времена нанотехнологий, инновационных центров и искусственного интеллекта, где-то на просторах континентальной России работает обычное предприятие, которое занимается производством металлоконструкций. Главным технологическим процессом является сварка рамных изделий.…
Apple выпускает важные релизные обновления с закрытием уязвимостей, а также свежие бета-версии, презентация iPhone 14 может пройти в режиме реального времени, сейчас можно скачать удалённые приложения банков из App Store, и на видео показан прототип невыпущенного AirPower. Эти и другие события в новом выпуске дайджеста – приглашаем к прочтению! Перейти к новостям