Rundeck 安全漏洞

Rundeck is an open source automation service with a web console, command line tools, and webAPI from Rundeck, Inc. in the United States, which is primarily used to run automation tasks. A security vulnerability in versions of Rundeck prior to 3.4.5 allows authenticated users to make requests to...

WordPress WP School Calendar plugin <= 3.5.10 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP School Calendar plugin versions = 3.5.10. Solution Update the WordPress WP School Calendar plugin to the latest available version at least 3.6...

WordPress Advanced Booking Calendar plugin <= 1.6.9 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Advanced Booking Calendar plugin versions = 1.6.9. Solution Update the WordPress Advanced Booking Calendar plugin to the latest available version at least 1.7.0...

WordPress Content Scheduler: Editorial Calendar and Notes plugin < 1.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Content Scheduler: Editorial Calendar and Notes plugin versions 1.2.0. Solution Update the WordPress Content Scheduler: Editorial Calendar and Notes plugin to the latest available version at least 1.2....

Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting

The plugin does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks As a contributor, create/edit an Event, add the following payload in a "Hourly Schedule" title, as well as any of...

WordPress Modern Events Calendar Lite plugin <= 6.3.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Rohan Chaudhari in WordPress Modern Events Calendar Lite plugin versions = 6.3.0. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 6.4.0...

WordPress Events Calendar Registration plugin <= 1.9.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Events Calendar Registration plugin versions = 1.9.2. Solution No patched version available...

WordPress The Events Calendar plugin < 5.14.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress Slider Addons for The Events Calendar plugin < 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Slider Addons for The Events Calendar plugin versions 1.0.1. Solution Update the WordPress Slider Addons for The Events Calendar plugin to the latest available version at least 1.0.1...

CVE-2022-25599

Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...

CVE-2022-25599

Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...

CVE-2022-25599 WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin versions = 4.9.0...

CVE-2022-25599

CVE-2022-25599 describes a CSRF vulnerability in the WordPress plugin Spiffy Calendar (versions ≤ 4.9.0) that allows an attacker to trigger event deletion due to missing token validation on the delete request. Multiple sources document the issue and confirm the affected component as the plugin’s ...

CommonsBooking < 2.6.8 - Unauthenticated SQL Injection

The plugin does not sanitise and escape the location parameter of the calendardata AJAX action available to unauthenticated users before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection PoC Create an "item" and a "location" via the newly added...

WordPress plugin 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site request forgery vulnerability exists in...

[SECURITY] Fedora 35 Update: cyrus-imapd-3.2.8-2.fc35

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

Fedora: Security Advisory for cyrus-imapd (FEDORA-2022-c30b1a8aa3)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The Events Calendar < 5.14.0 - Reflected Cross-Site Scripting

The plugin does not escape an aggregator URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting When there is an Event Aggregator license key active: https://example.com/wp-admin/edit.php?page=tribe-common&tab=imports&posttype=tribeevents&"alert/XSS/...

The Events Calendar < 5.14.0 - Reflected Cross-Site Scripting

The plugin does not escape an aggregator URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting PoC When there is an Event Aggregator license key active: https://example.com/wp-admin/edit.php?page=tribe-common=importstype=tribeevents&"...