CVE-2021-24952

The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the syncprogressivedata parameter for the tvcajaxproductsyncbantchwise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks...

CVE-2021-25038

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmussourceblog and wmusrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24952

The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the syncprogressivedata parameter for the tvcajaxproductsyncbantchwise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks...

CVE-2021-25038

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmussourceblog and wmusrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2021-25038

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmussourceblog and wmusrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

Cross site scripting

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmussourceblog and wmusrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2021-25038

CVE-2021-25038 affects the WordPress Multisite User Sync/Unsync plugin prior to 2.1.2. The vulnerability arises from failure to sanitize and escape the wmus_source_blog and wmus_record_per_page parameters before echoing them in HTML attributes, enabling a reflected cross-site scripting (XSS) cond...

PT-2022-9595

Name of the Vulnerable Software and Affected Versions WordPress Multisite User Sync/Unsync WordPress plugin versions prior to 2.1.2 Description The issue concerns Reflected Cross-Site Scripting, where the wmus source blog and wmus record per page parameters are not properly sanitised and escaped...

CVE-2021-25038: Improper Neutralization of Input During Web Page Generation

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmussourceblog and wmusrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

WordPress plugin Conversios.io SQL注入漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin for WordPress. SQL injection vulnerability exists in versions of WordPress...

PT-2022-9525

Name of the Vulnerable Software and Affected Versions Conversios.io WordPress plugin versions prior to 4.6.2 Description The issue allows any authenticated user to perform SQL injection attacks due to the lack of sanitization, validation, and escaping of the sync progressive data parameter for th...

PT-2022-37436

Name of the Vulnerable Software and Affected Versions spacewalk-java versions prior to 4.2.33-1 susemanager-sync-data versions prior to 4.2.11-1 Description The issue is related to handling a null pointer exception when syncing Ubuntu errata. There is also a change in CentOS 8 EOL URLs to vault. ...

WordPress Sync eCommerce NEO plugin <= 1.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Sync eCommerce NEO plugin versions = 1.4. Solution No patched version available...

WordPress Sync eCommerce NEO plugin <= 1.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Sync eCommerce NEO plugin versions = 1.4. Solution No patched version available...

WordPress Date Picker by Input WP – Sync bookings with external Calendars (.ics) plugin <= 2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin versions = 2.1. Solution Update the WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin to the latest available...

PT-2022-28913

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.6 Description The issue is related to the net/mlx5 driver in the Linux Kernel. It involves the use of del timer sync in the firmware reset flow of halting poll. The actual impact and attack plausibility hav...

Active Sync Gateway Connector isn't working with new devices since Update to 10.14 RP4

After upgrading from 10.14 RP3 - 10.14 RP4 any new enrolled device can't access to our Exchange Server via Active Sync Connector. After rebooting XenMobile server during the update process, we observe errors in the RemoteConfigService.log file as follows: Error |...

TotoLink routers 命令注入漏洞

TOTOLink T6 is a wireless dual-band router from TotoLink, China. recvmeshinfosync function of TOTOLink T6 is vulnerable to command injection. An attacker can exploit this vulnerability to execute arbitrary commands via specially crafted MQTT packets...

CVE-2022-0646

A flaw use after free in the Linux kernel Management Component Transport Protocol MCTP subsystem was found in the way user triggers cancelworksync after the unregisternetdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It...

PT-2022-17092

Name of the Vulnerable Software and Affected Versions TOTOLINK Technology router T6 V3 Firmware version T6 V3 V4.1.5cu.748 B20211015 Description A command injection issue in the recv mesh info sync function allows attackers to execute arbitrary commands via a crafted MQTT packet. This can be...