5688 matches found
CVE-2022-1663
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...
Cross site request forgery (csrf)
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...
CVE-2022-1663 Stop Spam Comments <= 0.2.1.2 - Access Token Bypass
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...
CVE-2022-3019
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one...
Default credentials
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one...
PT-2022-14032 · WordPress · Stop Comment Spam
Name of the Vulnerable Software and Affected Versions: Stop Spam Comments WordPress plugin versions 0.2.1.2 and earlier Description: The issue arises from the improper generation of the Javascript access token, which is intended to prevent abuse of the comment section. This allows threat authors ...
WordPress Robo Gallery 3.2.1 plugin - Bypass POST comment approvement Vulnerability
Title: WordPress 6.0 - Bypass POST comment approvement Robo Gallery 3.2.1 Author: nu11secur1ty Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/robo-gallery/ Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/RoboGallery Description:...
org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.3)
org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.4)
org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...
GHSA-8CWQ-4CMF-PX73 PocketMine-MP invalid skin geometry JSON data leading to server crash
Impact pocketmine\entity\Skin doesn't correctly handle errors produced by adhocore/json-comment, which throws RuntimeException rather than returning false as PocketMine-MP expects. This leads to a server crash if the skin geometry data is invalid for some reason e.g. a syntax error. Patches...
CVE-2021-41615
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 or RFC 2617 section 3.2.1. NOTE:...
Stop Spam Comments <= 0.2.1.2 - Access Token Bypass
The plugin does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request. PoC Collect the name and value of ssckey for the target post and use it on the request. curl...
Simple E-Learning System SQL Injection Vulnerability
Simple E-Learning System is a simple e-learning system from Carlo Montero's personal developer. Simple E-Learning System is vulnerable to SQL injection, which stems from a missing validation of external input SQL statements in the parameter postid of the file commentframe.php. statement. An...
org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.3)
org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...
org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (2.3)
org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...
org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (2.3)
org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (2.6.4)
org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (2.6.4)
org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.2), org.jenkins-ci.plugins:github-branch-source (>=2.0.1, <=2.0.8) +2 more potentially affected by CVE-2022-36883 via org.jenkins-ci.plugins:git (2.6.4)
org.jenkins-ci.plugins:git MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.2 - org.jenkins-ci.plugins:github-branch-sourc...
Some implementation mistakes in dnssec-oracle/BytesUtils.compare
Lines of code Vulnerability details Impact There are some implementation mistakes in dnssec-oracle/BytesUtils.compare. There should be a sanity check for offsets and lens if shortest 32 is not a correct condition. It should check the size of the last block. shortest is the total size of the bytes...