8008 matches found
CVE-2022-1793
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public...
CVE-2022-1793
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public...
Cross-Site Scripting (XSS)
intelliants/subrion is vulnerable to cross-site scripting. The vulnerability exists due to lack of validations when editing a blog entry which allows an attacker to modify the name of the uploaded images and execute arbitrary javascript...
CVE-2022-27174
Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...
CVE-2022-27174
Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...
CVE-2022-27174
Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...
CVE-2022-27174
CVE-2022-27174 affects the EC-CUBE4 ecosystem: the EC-CUBE plugin “Easy Blog for EC-CUBE4” (Ver.1.0.1 and earlier) is vulnerable to CSRF. A remote, unauthenticated attacker can hijack an administrator’s session via a specially crafted page and delete a blog article or a category. The vulnerabilit...
CVE-2022-27174
Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...
WordPress plugin Private Files 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
Threat Source newsletter (June 9, 2022) — Get ready for Cisco Live
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Another week, another conference. We’re heading a few miles southeast from San Francisco to Las Vegas for Cisco Live. I hope everyone had a safe, healthy and enjoyable RSA, but the fun isn’t over just... This is only...
Responsive Online Blog SQL Injection Vulnerability
Responsive Online Blog is a responsive online blog site. responsive Online Blog v1.0 is vulnerable to SQL injection, which stems from a lack of validation of external input SQL statements in the id parameter of single.php. An attacker could use this vulnerability to execute illegal SQL commands t...
@commercetools-docs/gatsby-theme-docs (>=0.0.0-canary-20211016203612, <=17.0.9), @zedvision/blog (>=14.0.1, <=14.3.6) +1 more potentially affected by CVE-2022-25863 via gatsby-plugin-mdx (>=2.0.0, <=2.14.0)
gatsby-plugin-mdx NPM version =2.0.0, =0.0.0-canary-20211016203612, =14.0.1, =13.0.5, =14.0.0 Source cves: CVE-2022-25863 Source advisory: OSV:GHSA-MJ46-R4GR-5X83...
Friday Squid Blogging: More on the “Mind Boggling” Squid Genome
Octopus and squid genes are weird. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
Akamai Protects Against the Atlassian Confluence 0-Day (CVE-2022-26134)
Atlassian has released a security advisory to address a remote code execution vulnerability CVE-2022-26134 that’s affecting Confluence Server and Data Center products...
CVE-2022-30823
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blogeventsedit.php...
CVE-2022-30818
Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blogeventsedit.php?id=31...
CVE-2022-30823
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blogeventsedit.php...