Modern Events Calendar Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A cross-site scripting vulnerability exists in the Wordpress Modern Events Calendar Lite plugin, which stems...

CVE-2022-30823

Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blogeventsedit.php...

CVE-2022-30823

CVE-2022-30823 affects Wedding Management System v1.0 and is caused by SQL Injection via the admin\blog_events_edit.php entry point. The vulnerability is documented across multiple feeds (NVD, CNVD, RH, etc.) with CVSS v3.1 base score 7.2 (HIGH) and CVSS v2.0 base score 6.5 (MEDIUM); impact inclu...

CVE-2022-30190

creationtimestamp| type| source ---|---|--- 2022-05-30 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2022/05/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/ 2022-05-31 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=813 2022-05-31...

Events Made Easy < 2.2.81 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Obtain a valid nonce visit the "Events" page, default is /events/, and extract it from the source while looking for...

WordPress Events Made Easy plugin <= 2.2.80 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Events Made Easy plugin versions = 2.2.80. Solution Update the WordPress Events Made Easy plugin to the latest available version at least 2.2.81...

Events Made Easy < 2.2.81 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection PoC Obtain a valid nonce visit the "Events" page, default is /events/, and extract it from the source while looking for...

Improper Verification of Cryptographic Signature in matrix-synapse

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

GHSA-CPPW-2MF8-QPM5 Improper Verification of Cryptographic Signature in matrix-synapse

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

CVE-2019-15598

creationtimestamp| type| source ---|---|--- 2022-05-24 17:04:00+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-j7fq-p9q7-5wfv 2024-03-15 15:22:00+00:00| seen| https://t.me/ctinow/208838 2024-04-23 19:45:02+00:00| seen| https://t.me/arpsyndicate/4772...

WordPress Spiffy Calendar plugin insecure direct object reference vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Spiffy Calendar plugin 4.9.0 and earlier versions are vulnerable to an insecure direct object...

CVE-2022-1729

A use-after-free flaw was found in the Linux kernel’s performance events functionality. A user triggers a race condition in setting up performance monitoring between the leading PERFTYPETRACEPOINT and sub PERFEVENTHARDWARE plus the PERFEVENTSOFTWARE using the perfeventopen function with these thr...

CVE-2022-29434

Insecure Direct Object References IDOR vulnerability in Spiffy Plugins Spiffy Calendar = 4.9.0 at WordPress allows an attacker to edit or delete events...

GHSA-V8FQ-GQ9J-3V7H OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...

OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

The MySQL token driver in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token...

Typo3 API XSS Vulnerability

Incomplete blacklist vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting XSS attacks via certain HTML5 JavaScript events...

GHSA-QH9X-MC42-VG4G django-anymail Includes Sensitive Information in Log Files

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...

django-anymail Includes Sensitive Information in Log Files

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...

GHSA-VMCC-4P4X-X7WG Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...