CVE-2022-23352: Loop with Unreachable Exit Condition

An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service DoS...

OESA-2022-1584 nodejs-fstream security update

Provides advanced file system stream objects for Node.js. These objects are like FS streams, but with stat on them, and support directories and symbolic links, as well as normal files. Also, you can use them to set the stats on a file, even if you don't change its contents, or to create a symlink...

ALBA-2022:0881 pcs bug fix and enhancement update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Bug Fixes and Enhancements: Enabling sbd before starting the cluster sets an incorrect validate-with value in /var/lib/pacemaker/cib/cib.xml BZ2042433...

pcs bug fix and enhancement update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Bug Fixes and Enhancements: Enabling sbd before starting the cluster sets an incorrect validate-with value in /var/lib/pacemaker/cib/cib.xml BZ2042433...

CVE-2022-0593

The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation...

Authorization

The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation...

CVE-2022-0593

The CVE-2022-0593 is linked to the WordPress plugin “Login with phone number” prior to version 1.3.7, where delete.php contains no authentication/authorization checks. This allows an unauthenticated remote attacker to delete plugin files, potentially causing DoS. Affected component: delete.php in...

Beers with Talos, Ep. #118: Reflecting on the current situation in Ukraine

Beers with Talos BWT Podcast episode No. 118 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherRecorded March 7, 2022. If iTunes and Google Play aren't your thing, click here. This was... This is only the beginning! Please...

PT-2022-13288

Name of the Vulnerable Software and Affected Versions Login with phone number WordPress plugin versions prior to 1.3.7 Description The issue allows an unauthenticated user to remotely delete plugin files due to the lack of authentication or authorization checks in the delete.php file placed in th...

CVE-2022-0593: External Control of File Name or Path

The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Team Circle Image Slider With Lightbox...

WordPress plugin 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A security vulnerability exists in Login with phon...

PT-2022-13328

Name of the Vulnerable Software and Affected Versions The Team Circle Image Slider With Lightbox WordPress plugin versions prior to 1.0.16 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the order pos parameter is not properly sanitized and escaped...

CVE-2022-0648: Improper Neutralization of Input During Web Page Generation

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the orderpos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

PT-2022-13532

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.2.12 Description The issue is related to Cross-site Scripting XSS - Stored, which was discovered in the microweber drag and drop website builder and CMS with e-commerce. There is no known workaround for this issu...

CVE-2022-0384: Exposure of Sensitive Information to an Unauthorized Actor

The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapigetwpusers AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog...

CVE-2022-25312

An XML external entity XXE injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions 2.7. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's...

PYSEC-2022-43051

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

PYSEC-2022-43051

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2021-24913 Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswsssaveattachmentdata AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media...