PT-2023-28116

Name of the Vulnerable Software and Affected Versions Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin versions 1.2 and earlier Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...

CVE-2023-41850: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin = 1.2 versions...

WordPress Plugin Outbound Link Manager Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Outbound Link Manager Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Outbound Link Manager Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41850 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c95f0f1dc27b Credits Rio Darmawan...

WordPress plugin ThirstyAffiliates Affiliate Link Manager licensing issue vulnerability (CNVD-2023-06534)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin ThirstyAffiliates Affiliate Link Manager 3.10.5 previously had a security...

CVE-2022-0398

The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an...

CVE-2022-0398

CVE-2022-0398 affects the WordPress plugin ThirstyAffiliates Affiliate Link Manager (versions

CVE-2022-0398: Cross-Site Request Forgery (CSRF)

The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an...

WordPress plugin ThirstyAffiliates 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin ThirstyAffiliates Affiliate Link Manager 3.10.5 previously had a security...

ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation

The plugin does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website fetch"/wp-admin/admin-ajax.php", "headers":...

WordPress ThirstyAffiliates Affiliate Link Manager plugin <= 3.10.4 - Arbitrary Affiliate Links Creation vulnerability

Arbitrary Affiliate Links Creation vulnerability discovered by Krzysztof Zając in WordPress ThirstyAffiliates Affiliate Link Manager plugin versions = 3.10.4. Solution Update the WordPress ThirstyAffiliates Affiliate Link Manager plugin to the latest available version at least 3.10.5...

WordPress ThirstyAffiliates Affiliate Link Manager plugin <= 3.10.4 - Unauthorized Image Upload + CSRF vulnerabilities

Unauthorized Image Upload + CSRF vulnerabilities discovered by Muhamad Hidayat in WordPress ThirstyAffiliates Affiliate Link Manager plugin versions = 3.10.4. Solution Update the WordPress ThirstyAffiliates Affiliate Link Manager plugin to the latest available version at least 3.10.5...

ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation

The plugin does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website PoC fetch"/wp-admin/admin-ajax.php", "headers"...

CVE-2021-35093

Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service in BlueCore...

Qualcomm 芯片缓冲区错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and from time to time manufactured on the surface of semiconductor wafers. A security vulnerability exists in qualcomm products that stems from...

CVE-2021-31787

The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown of a device by flooding the target device with LMPfeaturesres packets...

The vulnerability of the Bluetooth Classic microprogramming device implementations of Zhuhai Jieli ATS2815 and ATS2819 arises due to insufficient verification of input data. This allows a perpetrator to trigger a service failure.

The vulnerability of the Bluetooth Classic microprogramming device implementations of Zhuhai Jieli ATS2815 and ATS2819 exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures through the created LMP...

The vulnerability of the Bluetooth Classic environment for developing IoT applications allows a intruder to trigger a service failure.

The vulnerability in the Bluetooth Classic environment for IoT application development, espressif esp-idf, relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure using a specially crafted LMP package...

The vulnerability of the Bluetooth Classic microprogramming device implementations of Zhuhai Jieli ATS2815 and ATS2819 arises due to insufficient verification of input data. This allows a perpetrator to trigger a service failure.

The vulnerability of the Bluetooth Classic microprogramming device implementations of Zhuhai Jieli ATS2815 and ATS2819 exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures through the created LMP...

The vulnerability of the Bluetooth Classic microprogramming system implementation in Zhuhai Jieli AC690X devices arises due to insufficient verification of input data. This allows attackers to trigger malfunctions in the service process.

The vulnerability of the Bluetooth Classic microprogramming system implementation in Zhuhai Jieli AC690X devices exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker to cause service failures through the created LMP packet...