5347 matches found
PriceOracle Does Not Filter Price Feed Outliers
Handle leastwood Vulnerability details Impact If for whatever reason the Chainlink oracle returns a malformed price due to oracle manipulation or a malfunctioned price, the result will be passed onto users, causing unintended consequences as a result. In the same time it's possible to construct...
CVE-2021-27860
creationtimestamp| type| source ---|---|--- 2021-12-08 20:22:49+00:00| seen| https://t.me/cibsecurity/33616 2023-05-25 16:46:30+00:00| seen| MISP/7544e906-dfda-47ae-ae7b-3ec0d5e26b56 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 17:04:48+00:00| seen|...
CVE-2021-20038
creationtimestamp| type| source ---|---|--- 2021-12-08 12:23:42+00:00| seen| https://t.me/cibsecurity/33566 2021-12-09 11:10:00+00:00| seen| https://t.me/truesecator/2424 2022-01-11 02:27:37+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1299 2022-01-11 18:24:46+00:00|...
10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)
The plugin was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...
Chaty Free < 2.8.3 & Pro < 2.8.2 - Reflected Cross-Site Scripting
The plugins do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting http://example.com/wp-admin/admin.php?page=chaty-contact-form-feed&search=%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E...
WordPress Smash Balloon Social Post Feed Plugin < 4.0.1 XSS Vulnerability
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
WordPress Smash Balloon Social Post Feed Cross-Site Scripting Vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress Plugin is a WordPress open source application plugin. WordPress Smash Balloon Social Post Feed...
CVE-2021-24918
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...
CVE-2021-24918
CVE-2021-24918 affects the WordPress plugin Smash Balloon Social Post Feed (versions before 4.0.1). The root cause is missing privilege and nonce validation when saving plugin settings, allowing any logged-in user on a vulnerable site to update settings and store rogue JavaScript on posts and pag...
CVE-2021-24918 Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...
PT-2021-16367
Name of the Vulnerable Software and Affected Versions: Smash Balloon Social Post Feed WordPress plugin versions prior to 4.0.1 Description: The issue allows any logged-in user on a vulnerable site to update the plugin's settings without proper privilege or nonce validation. This enables the stora...
WordPress 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress Plugin is a WordPress open source application plugin. WordPress Smash Balloon Social Post Feed...
CVE-2021-41379
creationtimestamp| type| source ---|---|--- 2021-11-22 08:37:42+00:00| published-proof-of-concept| https://t.me/poxek/140 2021-11-22 09:30:27+00:00| published-proof-of-concept| https://t.me/hackertrick/464 2021-11-22 23:37:12+00:00| published-proof-of-concept| https://t.me/ckuRED/66 2021-11-22...
Using Object Storage with Veeam Products
Summary Veeam Backup & Replication supports object storage as a destination for long-term data storage. Similarly, Veeam Backup for Office 365 and cloud-specific offerings, such as Veeam Backup for AWS, Veeam Backup for Azure, Veeam Backup for Google Cloud Platform all support object storage. Thi...
CVE-2021-42292
creationtimestamp| type| source ---|---|--- 2021-11-10 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=690 2021-11-10 07:32:55+00:00| seen| https://t.me/thehackernews/1642 2021-11-10 07:41:45+00:00| seen| https://t.me/cibsecurity/32133 2021-11-10 12:44:04+00:00| seen|...
Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS
The plugin does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site...
Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS
The plugin does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site...
python-pillow: Excessive CPU use in EPS image reader
A flaw was found in python-pillow. The readline used in EPS has to deal with any combination of \r and \n as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a denial-of-service of Pillow in...
Permissioned nature of TwapOracle allows owner to manipulate oracle
Handle TomFrench Vulnerability details Impact Potentially frozen or purposefully inaccurate USDV:VADER price feed. Proof of Concept Only the owner of TwapOracle can call update on the oracle. Should the owner desire they could cease calling update on the oracle for a period. Over this period the...