Synology Photo Station 授权问题漏洞

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology Inc. of Taiwan, China. A session fixation vulnerability exists in Synology Photo Station, which can be exploited by attackers to bypass security constraints via unspecified vectors...

CVE-2022-22681

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors...

WordPress Gallery for Social Photo <= 1.0.0.29 - Cross-Site Request Forgery (CSRF) vulnerability leading to Post Duplication

Cross-Site Request Forgery CSRF vulnerability leading to Post Duplication discovered by Marco Wotschka in WordPress Gallery for Social Photo versions = 1.0.0.29. Solution No patched version available...

photo.cuboimages.it Cross Site Scripting vulnerability OBB-2703054

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Gallery for Social Photo < 1.0.0.29 - Arbitrary Post Duplication via CSRF

The plugin does not have CSRF check in place when duplicating a post or page, which could allow attackers to make a logged in a admin duplicate them via a CSRF attack https://example.com/wp-admin/admin-ajax.php?action=gifeedduplicatefeed&post=12...

Gallery for Social Photo < 1.0.0.29 - Arbitrary Post Duplication via CSRF

The plugin does not have CSRF check in place when duplicating a post or page, which could allow attackers to make a logged in a admin duplicate them via a CSRF attack PoC https://example.com/wp-admin/admin-ajax.php?action=gifeedduplicatefeed=12...

CVE-2013-1916

In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called executed even if the photo has not been yet approved...

CVE-2013-1916

In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called executed even if the photo has not been yet approved...

CVE-2013-1916

CVE-2013-1916 affects the WordPress Plugin User Photo 0.9.4. The issue is partial validation of uploaded images, allowing insertion of a backdoor on the server hosting WordPress, which can be executed even if the photo has not been approved. Descriptions across NVD/Red Hat/PRION entries confirm t...

LinkedIn: IDOR allows an attacker to delete anyone's featured photo.

An Insecure Direct Object Reference IDOR vulnerability allowed an attacker to delete anyone's featured photo on LinkedIn by manipulating the parameters in the delete request. This vulnerability was exploited by obtaining the necessary parameters from the victim's profile link and replacing them i...

Hindu Matrimonial Script 安全漏洞

PHP Matrimonial Script Hindu Matrimonial Script is an online matrimonial service website from PHP Matrimonial Script India. A security vulnerability exists in Hindu Matrimonial Script that stems from improperly managed permissions in /admin/photo.php...

MAL-2022-7336 Malicious code in yelp-react-component-photo-box (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf62968b39da6c0f32085698bb319e4089bc94d8fdfd0b0474282b77a6bae114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yelp-react-component-photo-box (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf62968b39da6c0f32085698bb319e4089bc94d8fdfd0b0474282b77a6bae114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in angular-cloudinary-photo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b59796ba271976005dde455be31a416442de0369ccdf3a101759a3ccdcaea1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Photo Gallery plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Photo Gallery plugin 1.15.5 and previous versions are vulnerable to cross-site request...

CVE-2021-36891

Cross-Site Request Forgery CSRF vulnerability in Photo Gallery by Supsystic plugin = 1.15.5 at WordPress allows changing the plugin settings...

CVE-2021-36891

Cross-Site Request Forgery CSRF vulnerability in Photo Gallery by Supsystic plugin = 1.15.5 at WordPress allows changing the plugin settings...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Photo Gallery by Supsystic plugin = 1.15.5 at WordPress allows changing the plugin settings...

CVE-2021-36891

The CVE describes a CSRF flaw in the WordPress Photo Gallery by Supsystic plugin (versions ≤ 1.15.5) that allows changing plugin settings without proper CSRF protection. The root cause is lack of CSRF checks when updating settings, enabling an attacker to trigger settings changes via a CSRF attac...

CVE-2022-20144

In multiple functions of AvatarPhotoController.java, there is a possible access to content owned by system content providers due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...