Smartphone shopaholic

Have you ever noticed strange reviews of Google Play apps that look totally out of place? Their creators might give it five stars, while dozens of users rate it with just one, and in some cases the reviews seem to be talking about some other program entirely. If so, you may be unknowingly...

Gitlab -- Multiple Vulnerabilities

The GitLab Team reports: Group Maintainers Can Update/Delete Group Runners Using API GraphQL Queries Can Hang the Application Unauthorized Users Have Access to Milestones of Releases Private Group Name Revealed Through Protected Tags API Users Can Publish Reviews on Locked Merge Requests DoS in t...

The vulnerability of the REVIEWS_CACHE component of the mintinstall program manager allows a hacker to execute arbitrary code.

The vulnerability of the REVIEWSCACHE component in the mintinstall manager is related to the restoration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

WordPress YITH WooCommerce Advanced Reviews plugin <= 1.3.9 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Advanced Reviews plugin versions = 1.3.9. Solution Update the WordPress YITH WooCommerce Advanced Reviews plugin to the latest available version at least 1.4.0...

WordPress Easy Digital Downloads Reviews extension cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Easy Digital Downloads EDD Reviews extension is a FAQ plugin used in it. A cross-site scripting vulnerability exists in the WordPress...

Design/Logic Flaw

The Easy Digital Downloads EDD Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9526

The Easy Digital Downloads EDD Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9526

The CVE refers to WordPress Easy Digital Downloads (EDD) Reviews extension. Vulnerable components are the EDD Reviews extension across multiple tracked versions (EDD 1.8.x before 1.8.7; 1.9.x before 1.9.10; 2.0.x before 2.0.5; 2.1.x before 2.1.11; 2.2.x before 2.2.9; 2.3.x before 2.3.7) due to mi...

Unpatched Bug Under Active Attack Threatens WordPress Sites with XSS

An unpatched vulnerability in the Rich Reviews plugin for WordPress is putting an estimated 16,000 sites in danger of stored cross-site scripting XSS attacks. Sites running the plugin are vulnerable to unauthenticated plugin option updates, which can be used to deliver malware payloads; and...

WordPress Rich Reviews plugin <= 1.7.4 - Unauthenticated Plugin Options Update vulnerability

Unauthenticated Plugin Options Update vulnerability found in WordPress Rich Reviews plugin versions = 1.7.4. Solution This plugin has been closed as of March 11, 2019 and is not available for download. Reason: Security Issue...

Rich Reviews <= 1.7.4 - Unauthenticated Plugin Options Update

This issue was found to be actively exploited in the wild by security vendor Wordfence. Refer to the references for further details...

Meet the BlueHat Content Advisory Board

We couldn’t do BlueHat without the Content Advisory Board, the brain trust reviewing submissions to the CFP. Representing both Microsoft and other parts of security community, the CAB applies their industry and speaker experience to create the BlueHat agenda that’s the right mix of topics and...

Malicious App on Google Play Tallies 100 Million Downloads

Call it the case of a good app gone bad! For some time, a handy PDF creator and optical character recognition OCR app available via Google Play offered users utility and convenience. The app, downloaded more than 100 million times, is called CamScanner and allows Android phone owners to snap a...

CVE-2019-15560

The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js...

CVE-2019-15560

The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js...

Sql injection

The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js...

CVE-2019-15560

The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js...

CVE-2019-15560

CVE-2019-15560 affects OpenSource Table’s Reviews Module, prior to 2019-06-14. The root cause is an SQL injection in database/index.js, enabling potentially unauthenticated network-based exploitation with high to critical impact (CVSS v2: 7.5; CVSS v3: 9.8). References indicate a patch discussion...

WordPress wp-customer-reviews plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress wp-customer-reviews plugin. An attacker can explo...

WordPress wp-customer-reviews plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress wp-customer-reviews plugin. An attacker can...