CVE-2021-24028

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00...

CVE-2021-24028

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00...

Design/Logic Flaw

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00...

WordPress Plugin Cross-Site Request Forgery Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . Cross-site request forgery vulnerability exists in the...

CVE-2021-24028

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00...

CVE-2021-24028

CVE-2021-24028 : A flaw in Facebook Thrift’s table-based serialization causes an invalid free, which can crash the application and potentially allow code execution. Affected software is Facebook Thrift prior to v2021.02.22.00. Remediation: upgrade to v2021.02.22.00 or newer. Note: exploitation de...

WordPress Facebook for WordPress Plugin < 3.0.0 PHP Object Injection Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Facebook for WordPress Plugin 3.0.x < 3.0.4 CSRF Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Facebook Thrift 安全漏洞

Facebook Thrift is a fork of Apache Thrift, a serialization and RPC framework for service communication from Facebook, USA. A security vulnerability exists in versions prior to Facebook Thrift v2021.02.22.00, which stems from an invalid free in Thrift's table-based serialization that could cause ...

CVE-2021-24217

The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...

CVE-2021-24218

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...

CVE-2021-24217

The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...

CVE-2021-24218

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...

Cross site request forgery (csrf)

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...

Design/Logic Flaw

The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...

CVE-2021-24218 Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion

The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved...

CVE-2021-24218

The CVE-2021-24218 entry concerns the Facebook for WordPress plugin (WordPress Facebook Pixel) versions before 3.0.4. Root cause: CSRF due to lack of nonce protection in the AJAX handlers wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings, with additional input sanitization gaps in saveFbe...

CVE-2021-24217 Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain

The runaction function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code...

CVE-2021-24217

The CVE-2021-24217 entry concerns the WordPress Facebook for WordPress plugin prior to version 3.0.0. The vulnerability arises because run_action deserializes user-supplied data, enabling PHP object injection, and an available magic method could be exploited to achieve remote code execution. Affe...

WordPress 插件 代码问题漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress Facebook for WordPress plugin has a security vulnerability prior to version 3.0.0, which can be exploited by attackers to achieve remote code execution via the available magic methods...