CVE-2023-48330

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

CVE-2023-48330

CVE-2023-48330 – WordPress Bulk Comment Remove CSRF (CSRF) vulnerability . The Bulk Comment Remove plugin (WordPress) is affected for versions <= 2, allowing Cross-Site Request Forgery. Public sources confirm the CVE and link it to unauthenticated CSRF risk with the vulnerable plugin, and Patc...

CVE-2023-48330 WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

CVE-2023-48330 WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

CVE-2023-48330: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2...

WordPress Plugin Bulk Comment Remove Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-30791 · Unknown · Mike Strand Bulk Comment Remove

Name of the Vulnerable Software and Affected Versions: Mike Strand Bulk Comment Remove versions prior to 2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is achieved by tricking the user...

Bulk Comment Remove <= 2 - Cross-Site Request Forgery via brc_admin()

Description The Bulk Comment Remove plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2. This is due to missing or incorrect nonce validation on the brcadmin function. This makes it possible for unauthenticated attackers to delete comments in bulk...

WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Bulk Comment Remove Type Plugin Vulnerable versions = 2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48330 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 07bea83de130 Credits Nguyen Xuan Chien...

CVE-2023-48031: Unrestricted Upload of File with Dangerous Type

OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute...

PT-2023-30676 · Unknown · Opensupports

Name of the Vulnerable Software and Affected Versions: OpenSupports version 4.11.0 Description: The issue allows an attacker to bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type in the comment function. This can enable the...

CISA Requests Comment on Draft Secure Software Development Attestation Form

CISA has opened a 30-day Federal Register notice to receive public comment on the draft Secure Software Development Attestation Form. CISA developed this form in coordination with the Office of Management and Budget. With the Secure Software Development Attestation Form, federal departments and...

Improper Access Control

microweber/microweber is vulnerable to Improper Access Control. This vulnerability exists because it does not properly restrict a user from commenting on an unpublished blog...

PT-2023-9143 · Unknown +2 · Stb Vorbis.C +2

Name of the Vulnerable Software and Affected Versions: stb vorbis.c version 1.22 Description: A heap-based buffer overflow vulnerability exists in the comment functionality of stb vorbis.c. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file ...

ManageEngine ServiceDesk Plus < 14.1 Build 14103

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.1 Build 14103. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2023-23078 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the...

ManageEngine AssetExplorer < 6.9 Build 6987

The version of ManageEngine AssetExplorer installed on the remote host is prior to 6.9 Build 6987. It is, therefore, affected by a vulnerability as referenced in the asset-explorerCVE-2023-23078 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the...

golang: html/template: improper handling of HTML-like comments within script contexts

A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This issue may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped...

Updated zlib packages fix a security vulnerability

The updated packages fix a security vulnerability: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. CVE-2023-45853...

Know Your Malware Part Two – Hacky Obfuscation Techniques

In the first post in this series, we covered common PHP encoding techniques and how they’re used by malware to hide from security analysts and scanners. In today’s post, we’re going to dive a little bit deeper into other obfuscation techniques that make use of other features available in PHP...