WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Smash Balloon Social Post Feed, which...

CVE-2020-19769

creationtimestamp| type| source ---|---|--- 2021-09-08 02:22:54+00:00| seen| https://t.me/cibsecurity/28410...

CVE-2021-37415

creationtimestamp| type| source ---|---|--- 2021-09-01 12:34:35+00:00| seen| https://t.me/cibsecurity/28145 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-05 00:47:32+00:00| seen| https://t.me/arpsyndicate/1347 2024-12-24 20:25:26+00:00| seen|...

python: CRLF injection via HTTP request method in httplib/http.client

A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat fr...

CVE-2021-32648

creationtimestamp| type| source ---|---|--- 2021-08-26 22:27:39+00:00| seen| https://t.me/cibsecurity/27916 2022-01-14 12:46:35+00:00| exploited| https://t.me/RussianOSINT/1142 2022-01-16 16:00:02+00:00| seen| https://t.me/secsocteam/227 2022-01-16 18:19:49+00:00| exploited|...

Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL Injection

The fetchproductajax functionality in the plugin uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Length: 162 Accept: / X-Requested-With:...

[SECURITY] Fedora 34 Update: newsflash-1.4.1-2.fc34

A modern feed reader designed for the GNOME desktop. NewsFlash is a program designed to complement an already existing web-based RSS reader account. It combines all the advantages of web based services like syncing across all your devices with everything you expect from a modern desktop program:...

[SECURITY] Fedora 34 Update: newsboat-2.24-1.fc34

Newsboat is a fork of Newsbeuter, an RSS/Atom feed reader for the text consol e...

WordPress Easy Social Feed plugin <= 6.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Easy Social Feed plugin versions = 6.2.6. Solution Update the WordPress Easy Social Feed plugin to the latest available version at least 6.2.7...

CVE-2021-32772

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allo...

CVE-2021-36742

creationtimestamp| type| source ---|---|--- 2021-07-30 00:14:37+00:00| seen| https://t.me/cibsecurity/26582 2021-08-13 05:19:44+00:00| exploited| https://t.me/cKure/6595 2021-08-13 18:53:59+00:00| exploited| https://t.me/truesecator/2002 2021-11-08 08:58:20+00:00| seen|...

OPENSUSE-SU-2021:2458-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 78.12 fixed: Sending an email containing HTML links with spaces in the URL sometimes resulted in broken links fixed: Folder Pane display theme fixes for macOS fixed: Chat account settings did not always save as...

Shopify: Blog posts atom feed of a store with password protection can be accessed by anyone

Hi shopify, DESCRIPTION I found a issue with blog posts atom feed of a shopify store. So without password we can't access the blog post atom feed at https://yourstore.myshopify.com/blogs/news.atom . But this can be bypass to access the atom feed of the blog posts. For example try out this. I have...

WordPress server-side request forgery vulnerability (CNVD-2021-59066)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. import-xml-feed of WordPress is vulnerable to server-side request forgery. No detailed vulnerability...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. import-xml-feed of WordPress is vulnerable to server-side request forgery. No detailed vulnerability...

IkaIka RSS Reader vulnerable to cross-site scripting

Overview IkaIka RSS Reader contains a cross-site scripting vulnerability CWE-79, due to the improper processing of RSS registration. LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a malicio...

IkaIka RSS Reader 跨站脚本漏洞

IkaIka RSS Reader is an online RSS reader. A cross-site scripting vulnerability exists in IkaIka RSS Reader that stems from insufficient filtering of user-supplied data in RSS feeds. A remote attacker could trick a victim into visiting a specially crafted link in a vulnerable website and execute...

Strategies, tools, and frameworks for building an effective threat intelligence team

How to think about building a threat intelligence program The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia...

Millions of Connected Cameras Open to Eavesdropping

Millions of connected security and home cameras contain a critical software vulnerability that can allow remote attackers to tap into video feeds, according to a warning from the Cybersecurity and Infrastructure Security Agency CISA. The bug CVE-2021-32934, with a CVSS v3 base score of 9.1 has be...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass for various web application security vulnerabilities and penetration testing. The repository includes tools and exploits for vulnerabilities such as CRLF injection,...