WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 Security Vulnerabilities

CVE-2022-3983 Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS

The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting...

Six Charged in Mass Takedown of DDoS-for-Hire Sites

The U.S. Department of Justice (DOJ) today seized four-dozen domains that sold "booter" or "stresser" services -- businesses that make it easy and cheap for even non-technical users to launch powerful Distributed Denial of Service (DDoS) attacks designed knock targets offline. The DOJ also charged....

A week in security (December 5 - 11)

Last week on Malwarebytes Labs: Security advisories are falling short. Here's why, with Dustin Childs: Lock and Code S03E25 Eufy "no cloud" security cameras streaming data to the cloud Snapchat gives Californians more power over their personal data Update now! Emergency fix for Google Chrome's V8.....

Huatian Power Collaboration Office System has information leakage vulnerability

Dalian Huatian Software Co., Ltd. is a high-tech enterprise established according to the international advanced management model and system, and is a collaborative management software company known for its leading technology. There is an information leakage vulnerability in Huatian Power...

Exploit for Code Injection in Apache Commons Text

text4shellburpscanner...

Main phishing and scamming trends and techniques

There are two main types of online fraud aimed at stealing user data and money: phishing and scams. Phishers primarily seek to extract confidential information from victims, such as credentials or bank card details, while scammers deploy social engineering to persuade targets to transfer money on.....

Watch out for this triple threat PayPal phish

ZDNet reports an interesting form of PayPal scam sent to one of their own writers. The scam is a so-called "triple threat" phish, in that it gives the scammer three different ways to potentially collect some ill gotten gains from potential victims. The idea is that if one of the three tactics...

CAPTCHA

This is an actual CAPTCHA I was shown when trying to log into PayPal. As an actual human and not a bot, I had no idea how to answer. Is this a joke? (Seems not.) Is it a Magritte-like existential question? (It's not a bicycle. It's a drawing of a bicycle. Actually, it's a photograph of a drawing...

Exploit for Authentication Bypass by Spoofing in Apache Apisix

POC 收集的POC CVE-2022-24112...

WordPress Donations via PayPal plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Donations via PayPal plugin version 1.9.9 has a cross-site scripting vulnerability that...

CVE-2022-3822

The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

CVE-2022-3822

The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

Cross site scripting

The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

CVE-2022-3822 Donations via PayPal < 1.9.9 - Admin+ Stored XSS

The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

Black Friday shoppers beware: online threats so far in 2022

The shopping event of the year, Black Friday, is almost here, and while the big day does not officially arrive until Friday, November 25th, deals are already starting. The day kickstarts the frenzied holiday shopping season with eye-catching promotional deals that lure shoppers into spending more.....

WordPress Checkout for PayPal plugin <= 1.0.13 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting (XSS) vulnerability discovered by Lana Codes in WordPress Checkout for PayPal plugin (versions &lt;= 1.0.13). Solution Update the WordPress Checkout for PayPal plugin to the latest available version (at least...

Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the following shortcode in a page/post...

Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting...

First Review of A Hacker’s Mind

Kirkus reviews A Hacker's Mind: A cybersecurity expert examines how the powerful game whatever system is put before them, leaving it to others to cover the cost. Schneier, a professor at Harvard Kennedy School and author of such books as Data and Goliath and Click Here To Kill Everybody,...

Exploit for Missing Authentication for Critical Function in Vmware Vcenter Server

VMware_vCenter_UNAuthorized_RCE_CVE-2021-21972 **zoomeye...

WordPress Metform <=2.1.3 - Information Disclosure

WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA.....

Experts Find URLScan Security Scanner Inadvertently Leaks Sensitive URLs and Data

Security researchers are warning of "a trove of sensitive information" leaking through urlscan.io, a website scanner for suspicious and malicious URLs. "Sensitive URLs to shared documents, password reset pages, team invites, payment invoices and more are publicly listed and searchable," Positive...

There is an RCE vulnerability

Description - There is an RCE vulnerability in qmpaas/leadshop (https://github.com/qmpaas/leadshop) (v1.4.15). An attacker can access the file leadshop.php and call any existing function through GET to control the target host. The vulnerability is in the leadshop/web/leadshop.php[27-61] file...

Donations via PayPal < 1.9.9 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). PoC 1. Click the 'Settings' button of this...

Donations via PayPal < 1.9.9 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

Exploit for Off-by-one Error in Sudo Project Sudo

CVE-2021-3156-centos7 利用sudo提权，只针对cnetos7 受影响版本： sudo: 1.8.2...

Exploit for Path Traversal in Apache Http Server

CVE-2021-41773 go语言poc&exp项目。 声明：该项目来自作者日常学习笔记。...

A weak password vulnerability exists in the Tianqing Application Delivery Control System of Qisda Information Technology Group Co.

Tianqing Application Delivery Control System is equipped with a virtualized cloud computing center traffic management solution. Ltd. Tianqing Application Delivery Control System has a weak password vulnerability, which attackers use to log into the system backend and obtain sensitive...

OpenSSL 3.0.0 to 3.0.6 decodes some punycode email addresses in X.509 certificates improperly

Overview Two buffer overflow vulnerabilities were discovered in OpenSSL versions 3.0.0 through 3.0.6. These vulnerabilities were introduced in version 3.0.0 with the inclusion of support for punycode email address parsing for X.509 certificates. OpenSSL's assessment of the severity of the...

APT10: Tracking down LODEINFO 2022, part I

Kaspersky has been tracking activities involving the LODEINFO malware family since 2019, looking for new modifications and thoroughly investigating any attacks utilizing those new variants. LODEINFO is sophisticated fileless malware first named in a blogpost from JPCERT/CC in February 2020. The...

Exploit for Expression Language Injection in Vmware Spring Cloud Gateway

Spring_All_Reachable...

13 Cybersecurity Horror Stories to Give you Sleepless Nights

Are we sitting comfortably? Twas a dark and stormy night, and the cybersecurity team stood patiently in their Scrum meeting. “Tell us a tale,” the CISO said, and one of their number raised their hand. They caught the eye of their colleagues, and began… 1. An artists tale Curious reader, gird thy...

Exploit for Improper Authentication in Fortinet Fortiproxy

CVE-2022-40684 CVE-2022-40684单独或者批量exp 食用方法 生成公钥...

Gin-vue-admin subject to Remote Code Execution via file upload vulnerability

Impact Gin-vue-admin &lt; 2.5.4 has File upload vulnerabilities。 File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could....

Gin-vue-admin subject to Remote Code Execution via file upload vulnerability

Impact Gin-vue-admin &lt; 2.5.4 has File upload vulnerabilities。 File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could....

kkFileView 4.1.0 - Cross-Site Scripting

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

Exploit for Path Traversal in Zimbra Collaboration

CVE-2022-37042 Usage 查看漏洞信息。 ```bash go run main.go -s...

Exploit for Code Injection in Apache Commons Text

cve-2022-42889-intercept 低于...

New PHP-based Ducktail infostealer is now after crypto wallets

A phishing campaign known to specifically target employees with access to their company's Facebook Business and Ads accounts has significantly widened its net and begun using a first-of-its-kind information-stealing malware to go after crypto wallets. The Ducktail (Woo-ooh!) campaign was first...

Microsoft Storage Location における構成の誤りに関する調査

本ブログは、Investigation Regarding Misconfigured Microsoft Storage...

ForceControl has a denial-of-service vulnerability (CNVD-2022-77992)

Forcecontrol is a monitoring and control configuration software, mainly used for data acquisition and monitoring control. A denial of service vulnerability exists in ForceControl, which can be exploited by attackers to cause a denial of...

DiceyF deploys GamePlayerFramework in online casino development studio

The Hacktivity 2022 security festival was held at the MOM Cultural Center in Budapest, Hungary, over two days, October 6-7th 2022. One of several presentations by our GReAT researchers included an interesting set of APT activity targeting online casino development and operations environments in...

Exploit for OS Command Injection in Telesquare Sdt-Cs3B1 Firmware

CVE-2022-26134_RCE 安装 ``` git clone...

セキュリティ更新プログラムの通知・配信の改善 – 新しい配信方法について

本ブログは、Improvements in Security Update Notifications Delivery – And a New Delivery Method...

Exploit for Expression Language Injection in Atlassian Confluence Data Center

CVE-2021-46422 RCE 安装 ``` git clone...

Exploit for OS Command Injection in Telesquare Sdt-Cs3B1 Firmware

CVE-2021-46422 RCE 安装 ``` git clone...

Exploit for OS Command Injection in Telesquare Sdt-Cs3B1 Firmware

CVE-2022-26134_RCE 安装 ``` git clone...

Exploit for Expression Language Injection in Atlassian Confluence Data Center

CVE-2022-26134_RCE 安装 ``` git clone...

Regulating DAOs

In August, the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned the cryptocurrency platform Tornado Cash, a virtual currency "mixer" designed to make it harder to trace cryptocurrency transactions--and a worldwide favorite money-laundering platform. Americans are now forbidden from....

Exploit for CVE-2022-23277

exch_CVE-2021-42321...