9398 matches found
PT-2021-16152
Name of the Vulnerable Software and Affected Versions Print My Blog WordPress Plugin versions prior to 3.4.2 Description The issue allows attackers to trick logged-in administrators into deactivating the Print My Blog plugin and deleting all saved data by opening a malicious link, due to the lack...
WP Import Export Lite < 3.9.5 - Subscriber+ Arbitrary Blog Options Update
The plugin does not have any CSRF and authorisation checks done in the wpieextsaveextensiondata AJAX action, nor do perform any validation on the option to be updated. As a result, any authenticated user such as subscriber, or an unauthenticated attacker via a CSRF could update any of the blog...
CVE-2021-24636: Cross-Site Request Forgery (CSRF)
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce CSRF checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link...
WordPress plugin cross-site request forgeing vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site request forgery vulnerability...
How to Protect and Support a Remote Workforce
By Owais Sultan If you felt as though you could be doing more to support your own remote workforce, here are some tips and pointers you might want to consider. This is a post from HackRead.com Read the original post: How to Protect and Support a Remote Workforce...
Integrate Serverless Security for Runtime Apps
Serverless solutions are prone to a high degree of application attacks. Learn how to build runtime application self-protection with vulnerability visibility and mitigation capabilities for your serverless applications...
Fantastic Blog CMS XSS
The vulnerability of the Fantastic Blog CMS content management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the search.php script...
CVE-2021-32202
In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...
CVE-2021-32202
In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...
CVE-2021-32202
In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...
CVE-2021-32202
In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation page...
CVE-2021-32202
CS-Cart 4.11.1 is affected by a cross-site scripting (XSS) vulnerability that can be triggered by manipulating the blog post description field during post creation. The root cause, as described in CNNVD, is insufficient validation/escaping of user input in the post description, enabling copy-past...
CS-Cart cross-site scripting vulnerabilities
CS-Cart is an e-commerce platform developed from the former open source PHP. A cross-site scripting vulnerability exists in CS-Cart version 4.11.1, which stems from the lack of effective validation and escaping of user input in the post description on the blog post creation page in the software,...
Exploit for Path Traversal in Microsoft
CVE-2021-40444 Analysis This repository contains the deobfusc...
More Detail on the Juniper Hack and the NSA PRNG Backdoor
We knew the basics of this story, but its good to have more detail. Heres me in 2015 about this Juniper hack. Heres me in 2007 on the NSA backdoor...
Lightning Cable with Embedded Eavesdropping
Normal-looking cables USB-C, Lightning, and so on that exfiltrate data over a wireless network. I blogged about a previous prototype here...
uListing < 2.0.9 - Arbitrary Blog Option Update via CSRF
The plugin does not have CSRF check in the uListingimportlayout function, nor perform any validation on the option/post meta key to update to ensure it belongs to the plugin. As a result, attackers could make a logged in admin change any of the blog option such as siteurl, blogname etc as well as...
uListing < 2.0.9 - Arbitrary Blog Option Update via CSRF
The plugin does not have CSRF check in the uListingimportlayout function, nor perform any validation on the option/post meta key to update to ensure it belongs to the plugin. As a result, attackers could make a logged in admin change any of the blog option such as siteurl, blogname etc as well as...
admindjango-ckeditor-blog (0.1.0), demosys-py (>=0.3.13, <=0.4.0) +3 more potentially affected by CVE-2021-23437 via pillow (4.1.1)
pillow PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - admindjango-ckeditor-blog 0.1.0 - demosys-py =0.3.13, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2021-23437 Source advisory: OSV:PYSEC-2021-317...
