9372 matches found
CVE-2022-23626 Insufficient file checks in m1k1o/blog
m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload function returned false, the original file that could contain a malicious payload was kept on the disk. Use...
CVE-2022-23626 Insufficient file checks in m1k1o/blog
m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload function returned false, the original file that could contain a malicious payload was kept on the disk. Use...
CVE-2022-23626
Vulnerability: CVE-2022-23626 in m1k1o/blog (PHP blog) where errors from imagecreatefrom* / image* were not checked, allowing the original uploaded file to remain on disk despite PHP warnings. Impact described as potential exposure of malicious payloads stored on disk; remediation advised is upgr...
PT-2022-16140 · Unknown · M1K1O/Blog
Name of the Vulnerable Software and Affected Versions: m1k1o/blog affected versions not specified Description: The issue concerns a lightweight self-hosted PHP blog, where errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload...
CVE-2022-23626: Improper Input Validation
m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload function returned false, the original file that could contain a malicious payload was kept on the disk. Use...
JetBrains Security Bulletin Q4 2021
JetBrains Security JetBrains Security Bulletin Q4 2021 Robert Demmer In the fourth quarter of 2021, we resolved a number of security issues in our products. Here’s a summary report that contains a description of each issue and the version in which it was resolved. Product | Description | Severity...
M1k1o Blog: Input validation error vulnerability
M1k1o Blog is a simple self-hosted, lightweight, single-user PHP blog where you can create your own Facebook-like feed. An input validation error vulnerability exists in M1k1o Blog, which stems from an error in the product functions imagecreatefrom and image that is not properly checked...
Blog Post Title Goes Here
The Blog description goes here...
blog.ipi.media Cross Site Scripting vulnerability OBB-2348151
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
blog.idahoan.com Cross Site Scripting vulnerability OBB-2347411
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Exploit for Out-of-bounds Write in Polkit_Project Polkit
CVE-2021-4034 self contained...
WordPress Accept Donations with PayPal plugin cross-site request forgery vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions of the Accept Donations with PayPal plug...
CVE-2021-24989
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog...
mysiteforme cross-site scripting vulnerability
Mysiteforme is a permission management system. mysiteforme suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the blog tagging function of the backend blog management. An attacker could exploit the vulnerability...
mysiteforme Cross-Site Request Forgery Vulnerability
Mysiteforme is a permission management system. A cross-site request forgery vulnerability exists in mysiteforme, which stems from a lack of validation for cross-site request forgery in the backend blog administration. An attacker could use a forged malicious request to trick a victim into clickin...
blog.contentrunner.com Cross Site Scripting vulnerability OBB-2343515
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Friday Squid Blogging: Piglet Squid
Nice article on the piglet squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
blog.businesstrainingworks.com Cross Site Scripting vulnerability OBB-2343232
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Threat Source Newsletter (Jan. 20, 2022)
Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. Even though we're nearly a month into 2022, we're still not quite ready to move on from 2021. That's why next week, we'll be going live on social media to talk about some of the top cybersecurity stories from the past... This is on...
