CVE-2021-20781

Cross-site request forgery CSRF vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

PT-2021-14236

Name of the Vulnerable Software and Affected Versions: WordPress Meta Data Filter & Taxonomies Filter versions prior to 1.2.8 WordPress Meta Data Filter & Taxonomies Filter versions prior to 2.2.8 Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the...

CVE-2021-20781: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

WordPress Plugin "WordPress Meta Data Filter & Taxonomies Filter" vulnerable to cross-site request forgery

Overview WordPress Plugin "WordPress Meta Data Filter & Taxonomies Filter" provided by realmag777 contains a cross-site request forgery vulnerability CWE-352. Ryoma Nishioka of Cryptography Laboratory, Department of Information and Communication Engineering, Tokyo Denki University reported this...

WordPress MDTF - Meta Data & Taxonomies Filter premium plugin <= 2.2.7.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Ryoma Nishioka in WordPress MDTF - Meta Data & Taxonomies Filter premium plugin versions = 2.2.7.2. Solution Update the WordPress MDTF - Meta Data & Taxonomies Filter premium plugin to the latest available version at least 2.2.8...

CVE-2021-32624 Private Field data leak

Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control...

CVE-2021-24289 Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin...

CVE-2021-24289

Store Locator Plus for WordPress (

CVE-2021-24289: Improper Privilege Management

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin...

PT-2021-15828

Name of the Vulnerable Software and Affected Versions Store Locator Plus for WordPress plugin versions prior to 5.5.15 Description The issue allows authenticated users to update their user meta data and gain administrator privileges on any site using the plugin. Recommendations For versions prior...

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

There is functionality in the plugin that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin. Partially unpatched because they added CSRF protection that technically blocks low-level users from using the endpoint, howeve...

Helium: SSRF By adding a custom integration on console.helium.com

A Server Side Request Forgery vulnerability was found in the Add a custom Integration feature on console.helium.com. By creating a custom HTTP integration, and setting the integration endpoint to http://169.254.169.254/latest/meta-data private meta-data from the AWS EC2 instance running can be...

PT-2021-11382

Name of the Vulnerable Software and Affected Versions: debug-meta-data plugin version 1.1.2 for WordPress Description: The issue allows for Cross-Site Scripting XSS attacks. XSS is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal...

340 weak JWT secrets you should check in your code

JSON Web Token JWT is the data format with bill-in signature and encryption mechanisms that are often used by modern web applications to store user sessions and application context, including authentication by SSO and meta-data. Usually, you can find JWT tokens in an Authentication Bearer HTTP...

340 weak JWT secrets you should check in your code

JSON Web Token JWT is the data format with bill-in signature and encryption mechanisms that are often used by modern web applications to store user sessions and application context, including authentication by SSO and meta-data. Usually, you can find JWT tokens in an Authentication Bearer HTTP...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4388-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4388-1 advisory. It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A...

8x8 Bounty: Open TURN relay abuse is possible due to lack of peer access control (Critical)

NOTE: This is not an SSRF vulnerability but an open TURN relay vulnerability. Typically, this security vulnerability has at least the same impact as an SSRF. However it is considered more useful from an attacker's point of view since attacks are not restricted to HTTP. - Affects: - █████:443 -...

[SECURITY] Fedora 31 Update: xar-1.8.0.417.1-1.fc31

The XAR project aims to provide an easily extensible archive format. Import ant design decisions include an easily extensible XML table of contents for ran dom access to archived files, storing the toc at the beginning of the archive to allow for efficient handling of streamed archives, the abili...

Fedora: Security Advisory for xar (FEDORA-2020-bbd24dd0cf)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Jenkins plug-in vulnerabilities: plaintext stored credentials disclosure-vulnerability warning-the black bar safety net

Jenkins is a widely used open source automation server, allows DevOps developers to efficiently and reliably build, test, and deploy software. In order to use Jenkins modular architecture, developers can plug-ins to extend its core features, allowing it to expand the script capabilities...