5844 matches found
note-mark
Note Mark !License: AGPL V3https://img.shields.io/github/li...
CVE-2021-21316
less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...
GHSA-XCF7-CJ8Q-PCJM XSS vulnerability in Author URL of themes in Mautic
Impact An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes. Patches Update to 2.14 or later Workarounds None References https://github.com/mautic/mautic/releases/tag/2.14.0 For more information If you have any questions or comments about this advisory: Email us at...
XSS vulnerability in Author URL of themes in Mautic
Impact An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes. Patches Update to 2.14 or later Workarounds None References https://github.com/mautic/mautic/releases/tag/2.14.0 For more information If you have any questions or comments about this advisory: Email us at...
Deserialization of untrusted data
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...
CVE-2020-35932
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...
WordPress Epsilon Framework SSRF / Denial of Service
Exploit Title: Wordpress Epsilon Framework Multiple Themes - Unauthenticated Function Injection Date: 22/12/2020 Exploit Authors: gx1 lotar Vendor Homepage: https://wordpress.com/ Software Link: https://github.com/WordPress/WordPress Affected Themes: shapely - Fixed in version 1.2.9 newsmag - Fix...
Wordpress Epsilon Framework Multiple Themes - Unauthenticated Function Injection
Exploit Title: Wordpress Epsilon Framework Multiple Themes - Unauthenticated Function Injection Date: 22/12/2020 Exploit Authors: gx1 lotar Vendor Homepage: https://wordpress.com/ Software Link: https://github.com/WordPress/WordPress Affected Themes: shapely - Fixed in version 1.2.9 newsmag - Fix...
Security update for MozillaThunderbird (important)
openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2020:2187-1 Rating: important References: 1178894 Cross-References: CVE-2020-15999 CVE-2020-16012 CVE-2020-26951 CVE-2020-26953 CVE-2020-26956 CVE-2020-26958 CVE-2020-26959 CVE-2020-26960 CVE-2020-26961...
WordPress Multiple Plugins / Themes Directory Traversal / File Download Vulnerability (HTTP)
Multiple WordPress Plugins / Themes are prone to a directory traversal or file download vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
RCE Vulnerability in WordPress Themes using the Epsilon Framework
Multiple WordPress themes using the Epsilon Framework are prone to a function injection vulnerability that could lead to remote code execution RCE. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...
Widespread Scans Underway for RCE Bugs in WordPress Websites
Millions of malicious scans are rolling across the internet, looking for known vulnerabilities in the Epsilon Framework for building WordPress themes, according to researchers. According to the Wordfence Threat Intelligence team, more than 7.5 million probes targeting these vulnerabilities have...
SW Ajax WooCommerce Search < 1.2.8 - Unauthenticated Reflected XSS & XFS
An Unauthenticated Reflected XSS & XFS vulnerabilities were discovered in the SW Ajax WooCommerce Search plugin v1.2.6 for WordPress. The plugin comes with a number of commercial themes such as: OneMall, Revo, eMarket, Autusin, Market, MaxShop, ShoppyStore, Furnicom, EtroStore, HiTheme, StyleShop...
SW Ajax WooCommerce Search < 1.2.8 - Unauthenticated Reflected XSS & XFS
An Unauthenticated Reflected XSS & XFS vulnerabilities were discovered in the SW Ajax WooCommerce Search plugin v1.2.6 for WordPress. The plugin comes with a number of commercial themes such as: OneMall, Revo, eMarket, Autusin, Market, MaxShop, ShoppyStore, Furnicom, EtroStore, HiTheme, StyleShop...
Multiple Themes - Unauthenticated Function Injection
Jerome Bruandet, from nintechnet, discovered numerous themes affected by Unauthenticated Function Injection issues, due to the lack of capability and CSRF nonce checks in AJAX actions. The naturemag-lite theme partially fixed the issues in v1.0.5, however it has been removed from the WordPress...
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
NinTechNet discovered multiple WordPress plugins and themes vulnerable to Cross-Site Request Forgery CSRF. The items only check the CSRF nonce if it has been provided, making them vulnerable to CSRF attacks if the nonce is removed. This is due to the confusing use of logic operators when verifyin...
CVE-2020-25378
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting XSS via the id GET parameter...
CVE-2020-25378
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting XSS via the id GET parameter...