PT-2024-21197 · WordPress · Wp Happy Coders Comments Like Dislike

Name of the Vulnerable Software and Affected Versions: WP Happy Coders Comments Like Dislike versions 1.2.2 and earlier Description: The issue is related to an Authentication Bypass by Spoofing vulnerability, which allows functionality bypass. Recommendations: For versions 1.2.2 and earlier, upda...

PT-2024-25550 · Webtechideas · Wti Like Post

Name of the Vulnerable Software and Affected Versions: webtechideas WTI Like Post versions 1.4.6 and earlier Description: The issue is related to an Authentication Bypass by Spoofing, allowing functionality bypass in the webtechideas WTI Like Post plugin. Recommendations: For versions 1.4.6 and...

CVE-2020-26312

Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target...

BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment

Description The plugin contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included in the request POST /wp-admin/admin-ajax.php HTTP/2 Host: buddyboss.example.com Cookie: REDACTED User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:120.0...

RHEL 7 : gnutls (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gnutls: Bleichenbacher-like side channel leakage in PKCS1 v1.5 verification and padding oracle verificati...

squashfs-tools: unvalidated filepaths allow writing outside of destination

A flaw was found in Squashfs-tools, where it is vulnerable to attacks similar to zip-slip. During extraction, a file can escape the destination directory either via the '../' string to access the parent directory or via symlinks. This flaw allows a specially crafted squashfs archive to install or...

WordPress WTI Like Post plugin <= 1.4.6 - IP Restriction Bypass Vulnerability vulnerability

IP Restriction Bypass Vulnerability vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WTI Like Post versions = 1.4.6...

Command injection via array-ish $command parameter of proc_open()

...

WordPress WTI Like Post Plugin <= 1.4.6 is vulnerable to Bypass Vulnerability

Software WTI Like Post Type Plugin Vulnerable versions = 1.4.6 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-33917 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 2def3782f557 Credits Mika Required privilege...

CVE-2024-32815

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Peters All-in-one Like Widget all-in-one-facebook-like-widget.This issue affects All-in-one Like Widget: from n/a through = 2.2.7...

CVE-2024-32815

CVE-2024-32815 affects the All-in-one Like Widget WordPress plugin (versions n/a through ≤2.2.7). It is described as an input handling vulnerability leading to Cross-site Scripting (XSS) during web page generation. The provided documents do not include exploitation details or a confirmed fix vers...

CVE-2024-32815 WordPress All-in-one Like Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Peters All-in-one Like Widget all-in-one-facebook-like-widget.This issue affects All-in-one Like Widget: from n/a through = 2.2.7...

WordPress plugin All-in-one Like Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2024-24889 · Unknown · All-In-One Like Widget

Name of the Vulnerable Software and Affected Versions: All-in-one Like Widget versions 2.2.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

WordPress All-in-one Like Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin All-in-one Like Widget versions = 2.2.7...

Researchers Uncover Windows Flaws Granting Hackers Rootkit-Like Powers

New research has found that the DOS-to-NT path conversion process could be exploited by threat actors to achieve rootkit-like capabilities to conceal and impersonate files, directories, and processes. "When a user executes a function that has a path argument in Windows, the DOS path at which the...

WordPress All-in-one Like Widget Plugin <= 2.2.7 is vulnerable to Cross Site Scripting (XSS)

Software All-in-one Like Widget Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.2.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32815 Patch priority Low CVSS severity Low 5.9 Developer Jeroen Peters PSID 19340c2d052a Credits Joshua Chan Required privilege...

The vulnerability of the implementations of CAS, SAML, and OpenID Connect protocols in the web application for deploying distributed social networks like Mastodon allows attackers to circumvent security restrictions and gain access to user accounts.

The vulnerability of the implementation of CAS, SAML, and OpenID Connect protocols in the web application for deploying distributed social networks like Mastodon is related to deficiencies in the authentication process due to changes in the email address during login to the system. Exploiting thi...

USN-6727-2: NSS regression

USN-6727-1 fixed vulnerabilities in NSS. The update introduced a regression when trying to load security modules on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that NSS incorrectly handled...

WordPress Plugin Popup Like box 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...