CVE-2021-24245: Improper Neutralization of Input During Web Page Generation

The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue...

PT-2021-15788

Name of the Vulnerable Software and Affected Versions Stop Spammers WordPress plugin versions prior to 2021.9 Description The issue arises from insufficient escaping of user input when blocking requests, such as matching a spam word. This leads to a reflected Cross-Site Scripting issue because th...

Command injection in launchpad

All versions of package launchpad are vulnerable to Command Injection via stop...

GHSA-7H8X-WMQ2-7MFF Command injection in launchpad

All versions of package launchpad are vulnerable to Command Injection via stop...

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

The plugin did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. PoC From an IP not in the Allow List...

WordPress Stop Spammers plugin <= 2021.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Hoseinvita in WordPress Stop Spammers plugin versions = 2021.8. Solution Update the WordPress Stop Spammers plugin to the latest available version at least 2021.9...

CVE-2021-21627

A cross-site request forgery CSRF vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains...

CVE-2021-21627: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains...

Apache Tomcat <= 5.5.25 CSRF Vulnerability - Linux

Apache Tomcat is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

Remote Code Execution (RCE)

launchpad is vulnerable to remote code execution RCE. The vulnerability exists through execcommand in the stop function...

CVE-2021-23330

All versions of package launchpad are vulnerable to Command Injection via stop...

CVE-2021-23330

All versions of package launchpad are vulnerable to Command Injection via stop...

CVE-2021-23330 Command Injection

All versions of package launchpad are vulnerable to Command Injection via stop...

CVE-2021-23330

All versions of package launchpad are vulnerable to Command Injection via stop...

Bitovi Launchpad Command Injection Vulnerability

Bitovi Launchpad is a Javscript-based software from Bitovi Canada that provides native browser functionality for Mac Os, Windows, and Linuxlike. A command injection vulnerability exists in all versions of launchpad that allows injection via the stop command...

PT-2021-15439

Name of the Vulnerable Software and Affected Versions launchpad versions all Description The issue concerns Command Injection via the stop function. Recommendations For all versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability...

Android App "ELECOM File Manager" vulnerable to directory traversal

Overview Android App "ELECOM File Manager" provided by ELECOM CO.,LTD. contains a directory traversal vulnerability CWE-22 due to a flaw in the processing of the filenames when extracting the compressed files. Ryohei Koike reported this vulnerability to IPA. JPCERT/CC coordinated with the develop...

JVN#98115035: Android App "ELECOM File Manager" vulnerable to directory traversal

Android App "ELECOM File Manager" provided by ELECOM CO.,LTD. contains a directory traversal vulnerability CWE-22 due to a flaw in the processing of the filenames when extracting the compressed files. Impact A remote attacker may create an arbitrary file or overwrite an existing file in a directo...

Command Injection

Overview launchpad is a You can launch browsers! From NodeJS! Local ones! Remote ones! Browserstack ones! Affected versions of this package are vulnerable to Command Injection via stop. Remediation Upgrade launchpad to version 0.8.0 or higher. References - GitHub Commit - GitHub Issue - GitHub PR...

X (Formerly Twitter): Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links

Summary: A chain of two open redirects on analytics.twitter.com and twitter.com, coupled with the use of an Ideographic Full Stop allows an attacker to defeat Twitter's approach to blocking links. Description: Twitter maintains a deny list of domain names and prevents users from tweeting direct o...