CVE-2022-2241: Improper Encoding or Escaping of Output

The Featured Image from URL FIFU WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, ...

PT-2022-15412 · WordPress · Featured Image From Url

Name of the Vulnerable Software and Affected Versions: Featured Image from URL FIFU WordPress plugin versions prior to 4.0.1 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2022-33016

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.201 Description The issue is related to the handling of FROM DEVICE buffers at the start of DMA transfers in the arm64 architecture. The actual impact and potential for attacks have not been fully determined...

PT-2022-32756

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.50 Description The issue is related to the handling of FROM DEVICE buffers at the start of DMA transfers in the arm64 architecture. The actual impact and potential for attacks have not been proven yet...

PT-2022-32907

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.125 Description The issue is related to the handling of FROM DEVICE buffers at the start of DMA transfers in the arm64 architecture. The actual impact and potential for attacks have not been proven yet...

PT-2022-32557

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.6 Description The issue is related to the handling of FROM DEVICE buffers at the start of DMA transfers in the arm64 architecture. The actual impact and potential for attacks have not been proven yet...

CVE-2022-33994

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to...

CVE-2022-33994

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to...

CVE-2022-33994

CVE-2022-33994 affects the WordPress Gutenberg plugin up to version 13.7.3. The vulnerability is a stored XSS via the SVG document when using the Insert from URL feature, exploitable by a Contributor, with the XSS payload not executing in the WordPress domain context. The description notes that s...

WordPress plugin Gutenberg 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2022-21956 · WordPress · Gutenberg

Name of the Vulnerable Software and Affected Versions: Gutenberg plugin versions through 13.7.3 for WordPress Description: The issue allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. The XSS payload does not execute in the context of the WordPress...

CVE-2022-33994: Improper Neutralization of Input During Web Page Generation

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to...

vinaseed.com.vn Cross Site Scripting vulnerability OBB-2791575

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-2118

creationtimestamp| type| source ---|---|--- 2022-07-17 14:27:45+00:00| seen| https://t.me/cibsecurity/46388...

PT-2022-14036

Name of the Vulnerable Software and Affected Versions Insights from Google PageSpeed WordPress plugin versions prior to 4.0.7 Description The issue concerns a lack of CSRF verification in the plugin, allowing attackers to perform actions such as deleting Custom URLs on behalf of a logged-in admin...

CVE-2022-1672: Cross-Site Request Forgery (CSRF)

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks...

nobull.com Cross Site Scripting vulnerability OBB-2749158

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Memory corruption

A memory corruption in Hex Rays Ida Pro v6.6 allows attackers to cause a Denial of Service DoS via a crafted file. Related to Data from Faulting Address controls subsequent Write Address starting at msvcrt!memcpy+0x0000000000000056...

Regular Expression Denial Of Service (ReDoS)

moment is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists due to the inefficient regex pattern used in the preprocessRFC2822 function of from-string.js, allowing an attacker to crash the application by providing malicious inputs of more than 10k characters...

CVE-2022-2058

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010...