9150 matches found
WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
The plugin does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfilteredhtml capability is disallowed. PoC 1. Add a new Import at "New Import", upload a random.tx...
PT-2021-12073
Name of the Vulnerable Software and Affected Versions: Delete All Comments Easily WordPress plugin versions 1.3 and earlier Description: The issue is related to a lack of Cross-Site Request Forgery CSRF checks in the plugin. This could allow an unauthenticated attacker to make a logged-in admin...
CVE-2020-36505: Cross-Site Request Forgery (CSRF)
The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery CSRF checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog...
WordPress 跨站请求伪造漏洞
WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Delete All Comments Easily plugin in version 1.3 and earlier is vulnerable to cross-site request forgery, which can ...
Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)
On October 4, 2021, Apache HTTP Server Project released Security advisory on a Path traversal and File disclosure vulnerability in Apache HTTP Server 2.4.49 and 2.4.50 tracked as CVE-2021-41773 and CVE-2021-42013. In the advisory, Apache also highlighted “the issue is known to be exploited in the...
Microsoft Digital Defense Report shares new insights on nation-state attacks
Microsoft is proud to promote Cybersecurity Awareness Month as part of our ongoing commitment to security for all. Year-round, Microsoft tracks nation-state threat activities to help protect organizations and individuals from these advanced persistent actors. We’re constantly improving our...
GHSA-4MVJ-RQ4V-2FXW Prototype Pollution in x-assign
This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object...
all-electronics.de Cross Site Scripting vulnerability OBB-2189278
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-23452
This affects all versions of package x-assign. The global proto object can be polluted using the proto object...
CVE-2021-35550
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated...
CVE-2021-37136
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data which affects the allocation size used during decompression. All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack...
bristolallheart.com Improper Access Control vulnerability OBB-2182567
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2021-30192
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.11 through v5.14.9 Description A potential issue exists in the RDMA/cma component, specifically in the rdma cma listen on all function, where a listener leak can occur upon failure. The actual impact and attack...
PT-2021-26121
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10.4 through v5.10.70 Description A potential issue exists in the RDMA/cma component, specifically in the rdma cma listen on all function, where a listener leak can occur upon failure. The actual impact and attack...
PT-2021-30116
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10.4 through v5.10.70 Description A potential issue exists in the RDMA/cma component, specifically in the rdma cma listen on all function, where a listener leak can occur upon failure. The actual impact and likelihood ...
Verizon’s Visible Wireless Carrier Confirms Credential-Stuffing Attack
On Wednesday, Verizon’s Visible – an all-digital, uber-cheap wireless carrier – confirmed what customers have been complaining about on Reddit and Twitter all week: They lost control of their accounts; had their passwords and shipping addresses changed; and some got stuck with bills for pricey ne...
Config Handler 安全漏洞
Config Handler is an open source package. It is used for loading configurations, deep merging packages, global, and environments. Config Handler has a security vulnerability that stems from the fact that all versions of the package configuration handler are susceptible to prototype contamination...
CVE-2021-41918
webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the...
CVE-2021-41918
webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the...
