WordPress WP Meta SEO Plugin < 4.5.5 is vulnerable to Deserialization of untrusted data

Software WP Meta SEO Type Plugin Vulnerable versions 4.5.5 Fixed in 4.5.5 OWASP Top 10 A1: Injection Classification Deserialization of untrusted data CVE CVE-2023-1381 Patch priority Medium CVSS severity Medium 6.6 Developer Claim ownership PSID 9880ffba76ab Credits Alex Sanford Required privileg...

CVE-2023-28646: Improper Authentication

Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta...

CVE-2020-36666

The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPre...

PT-2023-11833 · E Plugins · Final-User-Wp-Frontend-User-Profiles +9

Name of the Vulnerable Software and Affected Versions: directory-pro WordPress plugin versions prior to 1.9.5 final-user-wp-frontend-user-profiles WordPress plugin versions prior to 1.2.2 photographer-directory WordPress plugin versions prior to 1.0.9 real-estate-pro WordPress plugin versions pri...

PT-2023-17834 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a missing bounds check in the initialization of VendorGraphicBufferMeta, which could lead to an out of bounds read. This might result in local information disclosure, requiring System...

Threat Source newsletter (March 23, 2023) — Meta is threatening to ban news sharing in Canada. Good.

Welcome to this weeks edition of the Threat Source newsletter. After asking ChatGPT to write the newsletter for me two weeks ago, I was tempted to have Googles Bard do the same, but I resisted making this the newsletters new gimmick. Instead, I wanted to write about another tech giant -- Meta. Th...

CVE-2023-28659

The Waiting: One-click Countdowns WordPress Plugin, version = 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdownmetaid parameter of the pbcsavedowns action...

CVE-2023-28664

CVE-2023-28664 (WordPress MDTF plugin) affects WordPress Meta Data and Taxonomies Filter Plugin versions before 1.3.1. A reflected cross-site scripting vulnerability exists in the tax_name parameter of the mdf_get_tax_options_in_widget action that can be triggered by an authenticated user. The is...

WordPress Meta Slider Plugin <= 3.29.0 is vulnerable to Cross Site Scripting (XSS)

Software Meta Slider Type Plugin Vulnerable versions = 3.29.0 Fixed in 3.29.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2e34a11fb393 Credits WordFence Required privilege...

CVE-2023-28659: Improper Neutralization of Special Elements used in an SQL Command

The Waiting: One-click Countdowns WordPress Plugin, version = 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdownmetaid parameter of the pbcsavedowns action...

CVE-2023-28664: Improper Neutralization of Input During Web Page Generation

The Meta Data and Taxonomies Filter WordPress plugin, in versions 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'taxname' parameter of the mdfgettaxoptionsinwidget action, which can only be triggered by an authenticated user...

WordPress plugin metadata and taxonomies: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

ambition-edc (>=0.2.8, <=0.3.28), meta-edc (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2023-28117 via sentry-sdk (0.9.0)

sentry-sdk PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - ambition-edc =0.2.8, =0.1.0, =0.1.0a23, =2.0.0b6 Source cves: CVE-2023-28117 Source advisory: OSV:GHSA-29PR-6JR8-Q5JM...

US Citizen Hacked by Spyware

The New York Times is reporting that a US citizens phone was hacked by the Predator spyware. A U.S. and Greek national who worked on Meta’s security and trust team while based in Greece was placed under a yearlong wiretap by the Greek national intelligence service and hacked with a powerful...

CVE-2023-0876

The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability...

CVE-2023-0911

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta except the userpass, such as the user email and activati...

CVE-2023-0876

The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability...

CVE-2023-0911

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta except the userpass, such as the user email and activati...

Default credentials

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta except the userpass, such as the user email and activati...

CVE-2023-0911 Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta except the userpass, such as the user email and activati...