CVE-2023-0254

The CVE-2023-0254 entry concerns the WordPress plugin Simple Membership WP user Import (versions up to 1.7). The root cause is insufficient escaping of the orderby parameter, enabling an authenticated administrator to inject SQL into existing queries and potentially extract sensitive data from th...

CVE-2023-0254 Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection

The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges...

WordPress Simple Membership WP user Import Plugin <= 1.7 is vulnerable to SQL Injection

Software Simple Membership WP user Import Type Plugin Vulnerable versions = 1.7 Fixed in 1.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0254 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 22216492afda Credits Etan Imanol Castro Aldrete Required...

Security Bulletin: IBM TRIRIGA discloses CVE-2015-0254

Summary IBM TRIRIGA discloses CVE-2015-0254 Vulnerability Details CVEID:CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. By sending...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server that is shipped with IBM Intelligent Operations Center and related products (CVE-2015-0254)

Summary IBM WebSphere Application Server is shipped as a component of IBM Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been identified and published in a security bulletin. Vulnerability Details Consult the security...

GHSA-PM78-WXXF-FW98 Cross-site scripting in Apache Tomcat

Cross-site scripting XSS vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly...

Cross-site scripting in Apache Tomcat

Cross-site scripting XSS vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly...

CVE-2022-0254

creationtimestamp| type| source ---|---|--- 2022-03-14 17:18:15+00:00| seen| https://t.me/cibsecurity/38863...

CVE-2022-0254

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection...

CVE-2022-0254

WordPress Zero Spam plugin is vulnerable to SQL injection in admin dashboard due to improper sanitisation/escaping of order and orderby parameters. Affected versions are before 5.2.11 (noted by CVE records; Red Hat references 5.2.11; other advisories mention up to 5.2.13). The root cause is unsaf...

CVE-2022-0254 Zero Spam < 5.2.11 - Admin+ SQL Injection

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection...

Security Bulletin: OpenSource Apache Taglibs vulnerability affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) CVE-2015-0254

Summary OpenSource Apache Taglibs vulnerability affects IBM Spectrum Control and Tivoli Storage Productivity Center. IBM Spectrum Control and Tivoli Storage Productivity Center have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs coul...

Honeywell (CVE-2012-0254) (deprecated)

Plugin deprecated because honeywellprocess is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10. Deprecated...

Mageia: Security Advisory (MGASA-2018-0254)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2021-0254)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2015-0140)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2017-0254)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Apache Standard Taglibs Vulnerability Affects IBM Sterling B2B Integrator (CVE-2015-0254)

Summary IBM Sterling B2B Integrator has addressed the security vulnerability. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing...

Trojan-Dropper.Win32.Googite.b Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/4a8d6bc838c09c6701abfa8b283fd0de.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Googite.b Vulnerability: Unauthenticated Remote Command Execution Description:...

SUSE: Security Advisory (SUSE-SU-2017:1701-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...