WordPress Rich Reviews by Starfish plugin <= 1.9.14 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to review deletion discovered by Ngo Van Thien Patchstack Alliance in WordPress Rich Reviews by Starfish plugin versions = 1.9.14. Solution No patched version available...

WordPress Starfish Review Generation & Marketing for WordPress plugin <= 3.0.25 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Starfish Review Generation & Marketing for WordPress plugin versions = 3.0.25. Solution Update the WordPress Starfish Review Generation & Marketing for WordPress plugin to the latest available version ...

WordPress Starfish Review Generation & Marketing for WordPress plugin <= 3.0.25 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Starfish Review Generation & Marketing for WordPress plugin versions = 3.0.25. Solution Update the WordPress Starfish Review Generation & Marketing for WordPress plugin to the latest available version at least 3.0.26...

CVE-2021-24753

The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue...

CVE-2021-24753

The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue...

CVE-2021-24753 Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection

The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue...

WordPress和WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Rich Reviews by Starfish plugin in...

CVE-2021-24753: Improper Neutralization of Special Elements used in an SQL Command

The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue...

PT-2021-16254

Name of the Vulnerable Software and Affected Versions: The Rich Reviews by Starfish WordPress plugin versions prior to 1.9.6 Description: The issue arises from improper validation of the orderby GET parameter in the pending reviews page, which is then used in a SQL statement. This leads to an...

Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection

The plugin does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue error-based SQLI: orderby=id AND EXTRACTVALUE4795,CONCAT0x5c,0x717a627871,SELECT ELT4795=4795,1,0x7176707071 time-based...

starfish-pbx.org XSS vulnerability

Vulnerable URL: http://www.starfish-pbx.org/?s=\x3c\x2f\x74\x69\x74\x6c\x65\x3e\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x22\x58\x53\x53\x50\x4f\x53\x45\x44\x22\x29\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e Details: Description| Value ---|---...

CVE-2001-1006

Starfish Truesync Desktop 2.0b on the REX 5000 PDA stores sensitive files unencrypted and relies solely on password protection, enabling read access via another application. The CVE-2001-1006 entry notes lack of encryption with partial confidentiality impact, network‑level access, and no integrit...

CVE-2001-1007

CVE-2001-1007 affects Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA. The vulnerability arises from a small keyspace for device keys and the absence of a delay on incorrect keys, enabling faster brute-force guessing of the key. The NVD entry lists a MEDIUM base score (5.0/10) with net...

CVE-2001-1007

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered, which allows attackers to more quickly guess the key via a brute force attack...

CVE-2001-1006

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA does not encrypt sensitive files and relies solely on its password feature to restrict access, which allows an attacker to read the files using a different application...

CVE-2001-1005

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges...

CVE-2001-1005

CVE-2001-1005 affects Starfish Truesync Desktop 2.0b used on the REX 5000 PDA. The underlying issue is weak encryption used to store the user password in a registry key, enabling an attacker with registry access to decrypt the password and gain privileges. NVD lists CVSSv2 base score 7.5 (HIGH) w...

CVE-2001-1006: Undefined Security Weakness

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA does not encrypt sensitive files and relies solely on its password feature to restrict access, which allows an attacker to read the files using a different application...

CVE-2001-1007: Undefined Security Weakness

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses a small keyspace for device keys and does not impose a delay when an incorrect key is entered, which allows attackers to more quickly guess the key via a brute force attack...

CVE-2001-1005: Undefined Security Weakness

Starfish Truesync Desktop 2.0b as used on the REX 5000 PDA uses weak encryption to store the user password in a registry key, which allows attackers who have access to the registry key to decrypt the password and gain privileges...