CVE-2022-26948

The Archer RSS feed integration for Archer 6.x through 6.9 SP1 6.9.1.0 is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks...

Design/Logic Flaw

The Archer RSS feed integration for Archer 6.x through 6.9 SP1 6.9.1.0 is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks...

CVE-2022-26871

creationtimestamp| type| source ---|---|--- 2022-03-30 00:11:34+00:00| seen| https://t.me/cibsecurity/39779 2022-04-02 13:08:07+00:00| seen| https://t.me/cKure/9249 2022-04-04 14:40:00+00:00| exploited| https://t.me/truesecator/2803 2022-04-04 20:09:03+00:00| seen|...

CVE-2022-26948

The CVE-2022-26948 entry affects the Archer RSS feed integration in Archer 6.x up to 6.9 SP1 (6.9.1.0). The root cause is insecure credential storage, allowing a malicious actor to access credential information and potentially use it for further attacks. The available documents do not provide spe...

CVE-2022-26948

The Archer RSS feed integration for Archer 6.x through 6.9 SP1 6.9.1.0 is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks...

RSA Archer安全漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK, including policy, risk and compliance definition and management. It is able to aggregate all of our enterprise assets, as well as some of the monitored information, and organize it into a unified platform,...

CVE-2021-25068

The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feedid' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard...

CVE-2022-26904

creationtimestamp| type| source ---|---|--- 2022-03-28 11:00:54+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5692 2022-04-11 20:28:05+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve202226904superprofile.rb...

CVE-2022-1096

creationtimestamp| type| source ---|---|--- 2022-03-26 08:20:18+00:00| exploited| https://t.me/cKure/9175 2022-03-27 20:26:19+00:00| seen| https://t.me/NeKaspersky/2036 2022-03-28 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=763 2022-03-28 04:00:00+00:00| seen|...

Use of deprecated Chainlink function latestAnswer

Lines of code Vulnerability details function getCurrentPriceaddress asset external view overrideProviderOracleManager, IProviderOracleManager returns uint256 address assetOracle = getAssetOracleasset; IEACAggregatorProxy aggregator = IEACAggregatorProxyassetOracle; int256 answer =...

Pimcore data-hub 跨站脚本漏洞

Pimcore data-hub is a data delivery and consumption platform from Austrian company Pimcore. There is a security vulnerability in Pimcore data-hub, no information about the vulnerability is available at this time, please keep an eye on CNNVD or vendor announcements...

CVE-2021-24958 Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could...

CVE-2021-24958

CVE-2021-24958 affects the Meks Easy Photo Feed Widget WordPress plugin prior to version 1.2.4. Root cause: the meks_save_business_selected_account AJAX action lacks capability and CSRF checks and does not escape some settings, making it accessible to any authenticated user. Impact: any authentic...

CVE-2022-26143

creationtimestamp| type| source ---|---|--- 2022-03-09 18:35:18+00:00| exploited| https://t.me/NeKaspersky/1961 2022-03-10 11:58:50+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5572 2022-03-24 15:00:40+00:00| seen| Telegram/avpuSCeroSRuI6Q4LdhzIJlOMgwJSnzyUBpCKjrlyUT8...

WordPress Product Feed PRO for WooCommerce Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Product Feed PRO for WooCommerce Plugin before 11.2.3...

CVE-2022-0426

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

CVE-2022-0426

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

CVE-2022-0426

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

Sql injection

The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2022-0426 Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...