Abode Systems, Inc. iota All-In-One Security Kit web interface /action/ipcamRecordPost OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1563 Abode Systems, Inc. iota All-In-One Security Kit web interface /action/ipcamRecordPost OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-32586 SUMMARY An OS command injection vulnerability exists in the web interface...

Abode Systems, Inc. iota All-In-One Security Kit XCMD getVarHA memory corruption vulnerability

Talos Vulnerability Report TALOS-2022-1582 Abode Systems, Inc. iota All-In-One Security Kit XCMD getVarHA memory corruption vulnerability October 20, 2022 CVE Number CVE-2022-35244 SUMMARY A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iot...

CVE-2022-2628

The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2628

CVE-2022-2628 — DSGVO All in One for WP : Affects the WordPress plugin DSGVO All in One for WP (pre-4.2). The issue is that certain settings are not properly sanitised/escaped, which could allow a high-privilege user (e.g., Admin) to perform a Stored Cross‑Site Scripting (XSS) attack even when th...

DSGVO All in one for WP < 4.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Go the DSGVO AIO Settings Cookie Notice settin...

WordPress All in One SEO Pack Plugin < 4.2.4 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aioseo:allinoneseo"; if description...

CVE-2022-38093

Multiple Cross-Site Request Forgery CSRF vulnerabilities in All in One SEO plugin = 4.2.3.1 at WordPress...

Cross site request forgery (csrf)

Multiple Cross-Site Request Forgery CSRF vulnerabilities in All in One SEO plugin = 4.2.3.1 at WordPress...

CVE-2022-38093

CVE-2022-38093 affects the WordPress All in One SEO Pack plugin (versions

CVE-2022-38093 WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities in All in One SEO plugin = 4.2.3.1 at WordPress...

CVE-2022-38093 WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities in All in One SEO plugin = 4.2.3.1 at WordPress...

PT-2022-24197 · WordPress · All In One Seo

Name of the Vulnerable Software and Affected Versions: All in One SEO plugin versions prior to 4.2.3.1 Description: The issue concerns multiple Cross-Site Request Forgery CSRF vulnerabilities. CSRF is a type of attack where an attacker tricks a user into performing unintended actions on a web...

Server side request forgery (ssrf)

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

CVE-2022-2633

CVE-2022-2633 affects the WordPress All-In-One Video Gallery plugin (versions up to 2.6.0). The root cause is improper handling of the dl parameter in ~/public/video.php, enabling unauthenticated arbitrary file downloads and server-side request forgery (SSRF). Impact is unauthenticated access to ...

PT-2022-17789 · WordPress · All-In-One Video Gallery

Name of the Vulnerable Software and Affected Versions: All-in-One Video Gallery plugin for WordPress versions up to, and including 2.6.0 Description: The issue allows unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server via the dl...

WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Rafie Muhammad aka Yeraisci Patchstack Alliance in The WordPress All in One SEO plugin versions = 4.2.3.1. Solution Update the WordPress All In One SEO Pack plugin to the latest available version at least 4.2.4...

WordPress All-in-One WP Migration 7.64 plugin - Unauthenticated Backup Download Exploit

Title: All-in-One-WP-Migration-7.64 low-protection-file-disclosure - Unauthenticated Backup Download Author: nu11secur1ty Date: 09.01.2022 Vendor: https://servmask.com/ Software: https://wordpress.org/plugins/all-in-one-wp-migration/ Reference:...

WordPress All-in-One WP Migration plugin <= 7.62 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Team ISH Tecnologia in WordPress All-in-One WP Migration plugin versions = 7.62. Solution Update the WordPress All-in-One WP Migration plugin to the latest available version at least 7.63...

All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS

The plugin uses the wrong content type for, and does not properly escape the response from the ai1wmexport action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. "...