WordPress和WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Rich Reviews by Starfish plugin in...

Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection

The plugin does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue error-based SQLI: orderby=id AND EXTRACTVALUE4795,CONCAT0x5c,0x717a627871,SELECT ELT4795=4795,1,0x7176707071 time-based...

starfish-pbx.org XSS vulnerability

Vulnerable URL: http://www.starfish-pbx.org/?s=\x3c\x2f\x74\x69\x74\x6c\x65\x3e\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x22\x58\x53\x53\x50\x4f\x53\x45\x44\x22\x29\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e Details: Description| Value ---|---...

CVE-2001-1005

CVE-2001-1005 affects Starfish Truesync Desktop 2.0b used on the REX 5000 PDA. The underlying issue is weak encryption used to store the user password in a registry key, enabling an attacker with registry access to decrypt the password and gain privileges. NVD lists CVSSv2 base score 7.5 (HIGH) w...

CVE-2001-1006

Starfish Truesync Desktop 2.0b on the REX 5000 PDA stores sensitive files unencrypted and relies solely on password protection, enabling read access via another application. The CVE-2001-1006 entry notes lack of encryption with partial confidentiality impact, network‑level access, and no integrit...

CVE-2001-1007

CVE-2001-1007 affects Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA. The vulnerability arises from a small keyspace for device keys and the absence of a delay on incorrect keys, enabling faster brute-force guessing of the key. The NVD entry lists a MEDIUM base score (5.0/10) with net...

CVE-2001-1006

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA does not encrypt sensitive files and relies solely on its password feature to restrict access, which allows an attacker to read the files using a different application...

CVE-2001-1005

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges...

CVE-2001-1007

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered, which allows attackers to more quickly guess the key via a brute force attack...

CVE-2001-1005

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges...

CVE-2001-1006

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA does not encrypt sensitive files and relies solely on its password feature to restrict access, which allows an attacker to read the files using a different application...

CVE-2001-1007

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered, which allows attackers to more quickly guess the key via a brute force attack...