DEBIAN-CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

CVE-2021-30883

creationtimestamp| type| source ---|---|--- 2021-10-12 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=670 2021-10-12 04:46:19+00:00| exploited| https://t.me/thehackernews/1576 2021-10-12 10:09:20+00:00| exploited| https://t.me/truesecator/2203 2021-10-12 11:36:49+00:00|...

WordPress Smash Balloon Social Post Feed Plugin < 2.19.2 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

PT-2021-8119 · Apache +5 · Apache Traffic Server +6

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 5.5.1 and 4.3.9 Description: The issue is related to HTTP request smuggling when using Puma with a proxy that forwards HTTP header values containing the LF character. This could allow a client to smuggle a request throu...

CVE-2021-31988

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed CRLF control characters and include arbitrary SMTP headers in the generated test email...

PT-2021-19617 · Axis Communications +1 · Axis Os +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a user-controlled parameter in the SMTP test functionality that is not correctly validated. This allows an attacker to add...

Axis Os 注入漏洞

Axis Os is an edge device operating system from Axis of Sweden. An injection vulnerability exists in Axis devices AXIS OS version 5.51 and later versions, which stems from a failure to properly validate a control parameter related to the SMTP test function, and as a result, it is possible to add...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.6.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Huy Nguyen in WordPress WPeMatico RSS Feed Fetcher plugin versions = 2.6.11. Solution Update the WordPress Connections Business Directory plugin to the latest available version...

WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create/edit a campaign and add the following feed URL:...

WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create/edit a campaign and add the following feed URL:...

CVE-2021-24511

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24511

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

Sql injection

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

WordPress Easy Twitter Feed plugin <= 1.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Michał Lipiński in WordPress Easy Twitter Feed plugin versions = 1.1. Solution Update the WordPress Easy Twitter Feed plugin to the latest available version at least 1.2...

Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode PoC Log in as contributor and add the following shortco...

CVE-2021-38163

creationtimestamp| type| source ---|---|--- 2021-09-14 16:21:47+00:00| seen| https://t.me/cibsecurity/28795 2021-09-15 14:22:34+00:00| seen| https://t.me/ptswarm/72 2021-09-16 15:55:40+00:00| seen| https://t.me/truesecator/2111 2023-06-14 21:10:04+00:00| seen|...

CVE-2021-30632

creationtimestamp| type| source ---|---|--- 2021-09-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=648 2021-09-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=647 2021-09-14 10:58:48+00:00| exploited| https://t.me/truesecator/2098 2021-09-14...

CVE-2021-24508

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an...

CVE-2021-24508

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an...

CVE-2021-24508

The issue CVE-2021-24508 concerns the Smash Balloon Social Post Feed WordPress plugin prior to version 2.19.2. The vulnerability arises because the feed_locator AJAX action does not sanitize or escape the POST parameter feedID, and the truncated value is output in the admin dashboard. This leads ...