CVE-2021-36861

CVE-2021-36861 affects WordPress Rich Reviews by Starfish plugin versions <= 1.9.14. The issue is a Cross-Site Request Forgery (CSRF) that can let an attacker delete reviews. Concrete exploitation details are not provided in the documents; there is no explicit mention of in‑the‑wild exploits. ...

WordPress plugin Rich Reviews by Starfish 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2021-36861: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Rich Reviews by Starfish plugin = 1.9.14 at WordPress allows an attacker to delete reviews...

PT-2022-10583 · Starfish · The Rich Reviews By Starfish

Name of the Vulnerable Software and Affected Versions: Rich Reviews by Starfish plugin versions = 1.9.14 Description: A Cross-Site Request Forgery CSRF issue allows an attacker to delete reviews. Recommendations: For Rich Reviews by Starfish plugin versions = 1.9.14, update to a version higher th...

WordPress Rich Reviews by Starfish plugin <= 1.9.14 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to review deletion discovered by Ngo Van Thien Patchstack Alliance in WordPress Rich Reviews by Starfish plugin versions = 1.9.14. Solution No patched version available...

Rich Reviews <= 1.9.15 - Arbitrary Reviews Deletion via CSRF

The plugin does not have CSRF in place when deleting reviews, w which could allow attackers to make a logged in admin delete them via a CSRF attack...

CVE-2022-2108

The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it...

CVE-2022-2108

The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it...

CVE-2022-2108 Wbcom Designs – BuddyPress Group Reviews <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass

The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it...

Extortionists target restaurants, demand money to take down bad reviews

Restaurants and other eating establishments are being targeted by extortionists who post fake reviews online and then offer to remove them in exchange for a gift card. The possibility has always existed to leave poor reviews on Google Maps and elsewhere. However, seeing fraudsters get organised a...

CVE-2022-2108: Missing Authorization

The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it...

carperformancechipreviews.com Cross Site Scripting vulnerability OBB-2766987

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Off-by-one Error in Sudo_Project Sudo

CVE-2021-3156 Visualization, Fuzzing, Exploit and Patch...

Top Six Security Bad Habits, and How to Break Them

Cybercrime is on the rise, and attacks are getting faster, more nuanced and increasingly sophisticated. The number of cyberattack-related data breaches rose 27 percent in 2021 — an upward trend that shows no signs of slowing down. Bad security habits, such as using the same password more than onc...

Malicious code in woo-better-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c5fc72d3e1dfcc1d25abff23760de62aa6b51a12bd936f3e8b2ffefcc3dfa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7212 Malicious code in woo-better-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c5fc72d3e1dfcc1d25abff23760de62aa6b51a12bd936f3e8b2ffefcc3dfa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress BuddyPress Group Reviews plugin <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass

Unauthorized AJAX Actions due to Nonce Bypass discovered by Marco Wotschka / Wordfence in WordPress BuddyPress Group Reviews plugin versions = 2.8.3. Solution Update the WordPress BuddyPress Group Reviews plugin to the latest available version at least 2.8.4...

BuddyPress Group Reviews < 2.8.4 - Subscriber+ Arbitrary Settings Update & Review Modification

The plugin is missing capability and CSRF checks in various of its AJAX functions available to any authenticated users, which could allow users with a role as low as subscriber to update arbitrary settings and modify reviews...

WordPress Google Places Reviews plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2022-1772

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...