43 matches found
CVE-2022-29447
CVE-2022-29447 concerns the WordPress Hover Effects plugin (versions
CVE-2022-29447 WordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerability
Authenticated administrator or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Hover Effects plugin = 2.1 at WordPress...
CVE-2022-29447
Authenticated administrator or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Hover Effects plugin = 2.1 at WordPress...
Don't be afraid of XXE vulnerabilities: understand the beast and how to detect them
Today XML External Entities XXE vulnerabilities are still ubiquitous, despite the fact that recommendations to protect against them have been an integral part of security standards for years. In this post, the first in a series of three blog posts, we will try to demystify XXE vulnerabilities and...
WordPress 5.7 - (Media Library) XML External Entity Injection Authenticated Vulnerability
Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection XXE Authenticated Exploit Author: David Utón M3n0sD0n4ld Vendor Homepage: https://wordpress.com Affected Version: WordPress 5.6-5.7 & PHP8 Tested on: Linux Ubuntu 18.04.5 LTS CVE : CVE-2021-29447 !/bin/bash Author:...
WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)
Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection XXE Authenticated Date: 16/09/2021 Exploit Author: David Utón M3n0sD0n4ld Vendor Homepage: https://wordpress.com Affected Version: WordPress 5.6-5.7 & PHP8 Tested on: Linux Ubuntu 18.04.5 LTS CVE : CVE-2021-29447...
WordPress 5.7 Media Library XML Injection
Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection XXE Authenticated Date: 16/09/2021 Exploit Author: David Utón M3n0sD0n4ld Vendor Homepage: https://wordpress.com Affected Version: WordPress 5.6-5.7 & PHP8 Tested on: Linux Ubuntu 18.04.5 LTS CVE : CVE-2021-29447...
Exploit for Improper Restriction of XML External Entity Reference in Wordpress
CVE-2021-29447 Impact Arbitrary File Disclosure: the cont...
CVE-2021-29447
creationtimestamp| type| source ---|---|--- 2021-04-30 11:57:20+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/3142 2021-05-06 10:55:08+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/355 2021-05-21 12:56:23+00:00| seen|...
Debian: Security Advisory (DSA-4896-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4896-1 : wordpress - security update
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform XML External Entity XXE attacks, and access private content. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...
[SECURITY] [DSA 4896-1] wordpress security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4896-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 22, 2021 https://www.debian.org/security/faq -...
Debian: Security Advisory (DLA-2630-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 2630-1] wordpress security update
----------------------------------------------------------------------- Debian LTS Advisory DLA-2630-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta April 21, 2021 https://wiki.debian.org/LTS -...
WordPress 5.7 < 5.7.1 / 5.6 < 5.6.3 / 5.5 < 5.5.4 / 5.4 < 5.4.5 / 5.3 < 5.3.7 / 5.2 < 5.2.10 / 5.1 < 5.1.9 / 5.0 < 5.0.12 / 4.9 < 4.9.17 / 4.8 < 4.8.16 / 4.7 < 4.7.20
WordPress 5.7 5.7.1 / 5.6 5.6.3 / 5.5 5.5.4 / 5.4 5.4.5 / 5.3 5.3.7 / 5.2 5.2.10 / 5.1 5.1.9 / 5.0 5.0.12 / 4.9 4.9.17 / 4.8 4.8.16 / 4.7 4.7.20 is affected by multiple vulnerabilities: - A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library...
Exploit for Improper Restriction of XML External Entity Reference in Wordpress
WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-2944...
WordPress Multiple Vulnerabilities (Apr 2021) - Linux
WordPress is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2021-29447
CVE-2021-29447 is an XXE vulnerability in WordPress media handling (getID3 parsing WAV iXML chunks) that affects WordPress 5.6–5.7 on PHP 8+. Authenticated authors can upload a malicious WAV to trigger XML External Entity substitution (LIBXML_NOENT), enabling access to internal files. The issue i...
CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8
Wordpress is an open source CMS. A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has...