CVE-2021-24592

CVE-2021-24592 affects the WordPress Sitewide Notice WP plugin prior to version 2.3. The issue arises because the plugin does not sufficiently sanitize certain settings before rendering them on frontend pages, enabling Cross-Site Scripting (XSS) by high-privilege users even when unfiltered_html i...

CVE-2021-24592 Sitewide Notice WP < 2.3 - Authenticated Stored XSS

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cookie Notice & Compliance for GDPR / CCPA < 2.1.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfilteredhtml capability is disallowed. Put the following payload in the Button text setti...

CVE-2021-24592: Improper Neutralization of Input During Web Page Generation

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16107

Name of the Vulnerable Software and Affected Versions Sitewide Notice WP WordPress plugin versions prior to 2.3 Description The issue allows high privilege users to perform Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the plugin not sanitizing some ...

WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.1.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Cookie Notice & Compliance for GDPR / CCPA plugin versions = 2.1.3. Solution Update the WordPress Cookie Notice & Compliance for GDPR / CCPA plugin to the latest available version at least 2.1.4...

WordPress 插件跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. WordPress plugin Sitewide Notice before version 2.3 has a cross-site scripting vulnerability, the vulnerability stems from the plugin in its content output to the front-end page before the plugin does not validate and escape som...

CVE-2021-31114

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...

CVE-2021-31110

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...

CVE-2021-31112

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...

CVE-2021-31068

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...

CVE-2021-30974

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...

LSN-0080-1 Kernel Live Patch Security Notice

Andy Nguyen discovered that the netfilter subsystem in the Linux kernel contained an out-of-bounds write in its setsockopt implementation. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code.CVE-2021-22555...

PT-2021-20624

Name of the Vulnerable Software and Affected Versions: 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin versions up to and including 5.2.7 Description: The issue allows attackers to inject arbitrary web scripts via the vws notice function found in the /inc/requirements.ph...

ALPINE-CVE-2021-22923

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often...

WordPress Sitewide Notice WP <= 2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Sitewide Notice WP versions = 2.2. Solution Update the WordPress Sitewide Notice WP to the latest available version at least 2.3...

Sitewide Notice WP < 2.3 - Authenticated Stored XSS

The plugin does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Message setting of the plugin: The XSS will ...

LSN-0079-1: Kernel Live Patch Security Notice

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.CVE-2021-3600 It was discovered that the virtual file system...

Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy

✍️ Description CSRF bug when disabling notice 🕵️‍♂️ Proof of Concept no csrf token checking during enable/desable notice .\ Bellow request is vulnerable to csrf attack POST /index.php HTTP/1.1 Host: webdiplomacy.net User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:88.0 Gecko/20100101...

Vulnerabilities fixed in NVIDIA GPU Display Driver

Vulnerabilities have been fixed in NVIDIA GPU Display Driver. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Access to system data Increased user privileges NVIDIA has...