Friday Squid Blogging: Stubby Squid

Video of the stubby squid Rossia pacifica from offshore Vancouver Island. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered...

CVE-2024-54287

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through = 1.0.4...

CVE-2023-37995

Cross-Site Request Forgery CSRF vulnerability in Chetan Gole WP-CopyProtect Protect your blog posts plugin = 3.1.0 versions...

CVE-2020-18194

Cross Site Scripting XSS in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post...

Exploit for CVE-2025-37899

This is the artefact repository associated with my blog post Ho...

CVE-2017-20060

A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting Persistent. It is possible to initiate the attack remotely. Upgrading to version 1.3.13 i...

CVE-2017-1000463

Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

Working PoC for CVE-2025-32433 !ca...

CVE-2025-27733

creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-22 00:34:19+00:00| seen| https://infosec.exchange/users/wdormann/statuses/114378804966922705 2025-04-22 00:34:40+00:00| seen|...

Deepseek: Why it Matters and What the Press Got Wrong

...

GHSA-CRG3-FJM2-XVPQ

creationtimestamp| type| source ---|---|--- 2025-02-11 14:00:07+00:00| seen| https://daniel.haxx.se/blog/2025/02/11/disabling-cert-checks-we-have-not-learned-much/...

GHSA-9MGX-552F-59P6

creationtimestamp| type| source ---|---|--- 2025-02-11 09:53:02+00:00| seen| https://mastodon.social/users/bagder/statuses/113984640008586392 2025-02-11 10:01:07+00:00| seen| https://bsky.app/profile/bagder.mastodon.social.ap.brid.gy/post/3lhvf7dyo2642 2025-02-11 14:00:07+00:00| seen|...

CVE-2024-47776

creationtimestamp| type| source ---|---|--- 2024-12-17 12:51:51+00:00| seen| https://github.blog/security/vulnerability-research/uncovering-gstreamer-secrets/...

CVE-2024-54287

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through = 1.0.4...

CVE-2024-54287 WordPress Advanced Blog Post Block plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through = 1.0.4...

CVE-2024-54287

CVE-2024-54287 describes an Authenticated Stored Cross‑Site Scripting (XSS) in the WordPress plugin Advanced Blog Post Block (block named “Advanced Blog Post Block”). Affected are versions up to and including 1.0.4 (listed as affected “from n/a through 1.0.4”). Exact root cause details are not pr...

CVE-2024-54287: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through = 1.0.4...

WordPress plugin Advanced Blog Post Block 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress Advanced Blog Post Block plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab Patchstack Alliance in WordPress Plugin Advanced Blog Post Block versions = 1.0.4...

Artifact poisoning vulnerability in action-download-artifact v5 and earlier

Summary In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts such as malicious executables into a privileged...