CVE-2021-42358 Contact Form With Captcha <= 1.6.2 Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the /cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2...

CVE-2021-42358

The WordPress plugin “Contact Form With Captcha” is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the cfwc-form.php submission path, affecting versions up to 1.6.2. Connected sources corroborate this CSRF flaw and note the vulnerability can enable injection of...

CVE-2021-42358: Cross-Site Request Forgery (CSRF)

The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the /cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2...

PT-2021-23589

Name of the Vulnerable Software and Affected Versions Contact Form With Captcha WordPress plugin versions up to, and including 1.6.2 Description The issue is related to Cross-Site Request Forgery due to missing nonce validation in the /cfwc-form.php file during contact form submission. This allow...

PT-2021-16232

Name of the Vulnerable Software and Affected Versions The Logo Showcase with Slick Slider WordPress plugin versions prior to 1.2.4 Description The issue allows users with a role as low as Author to perform stored Cross-Site Scripting attacks. This is due to the lack of sanitization in the Grid...

CVE-2021-24729: Improper Neutralization of Input During Web Page Generation

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

Hancom With AnySign4Pc 路径遍历漏洞

Hancom With AnySign4Pc is an executable .exe file from the South Korean company Hancom With. A path traversal vulnerability exists in Hancom With AnySign4Pc. The vulnerability stems from exploiting the parameters of the getPFXFolderList function, which allows an attacker to see authorization...

@likenttt/waline-with-feishu (>=1.24.1, <=1.24.2), @waline/vercel (>=1.18.6, <=1.28.2) potentially affected by CVE-2020-21176 via thinkjs (3.2.14)

thinkjs NPM version 3.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on thinkjs and may be impacted: - @likenttt/waline-with-feishu =1.24.1, =1.18.6, =1.28.2 Source cves: CVE-2020-21176 Source advisory: OSV:GHSA-Q5MQ-6FJG-4MW8...

Beers with Talos, Ep. #111: We say goodbye to Craig and his killer robots

Beers with Talos BWT Podcast episode No. 111 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherIf iTunes and Google Play aren't your thing, click here. We apologize for holding onto this... This is only the beginning! Please...

CVE-2021-23146: Incomplete Comparison with Missing Factors

An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; 8.30 versions prior to 8.30.1359 MR3; 8.20 versions prior to 8.20.1259 MR5; 8.1...

PT-2021-16307

Name of the Vulnerable Software and Affected Versions: Accept Donations with PayPal WordPress plugin versions prior to 1.3.2 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the Amount Menu Name field of created Buttons not being properly escaped,...

CVE-2021-24815: Improper Neutralization of Input During Web Page Generation

The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

kernel security, bug fix, and enhancement update

4.18.0-348.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

with-step.com Cross Site Scripting vulnerability OBB-2273623

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Improper Access Control in janeczku/calibre-web

Description Although a user has no permissions about public shelves, he can create them. Proof of Concept The method createshelf at shelf.py does not check if the user has public shelf permissions for create it. @shelf.route"/shelf/create", methods="GET", "POST" @loginrequired def createshelf:...

CVE-2021-3915: Unrestricted Upload of File with Dangerous Type

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type...

isguc.org Cross Site Scripting vulnerability OBB-2253384

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-24767: Cross-Site Request Forgery (CSRF)

The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack...

PT-2021-21289

Name of the Vulnerable Software and Affected Versions Phone Shop Sales Managements System using PHP with Source Code version 1.0 Description The issue concerns an authentication bypass, which can lead to account takeover of the admin. This allows unauthorized access to the system, potentially...

PT-2021-16087 · WordPress · Accept Donations With Paypal

Name of the Vulnerable Software and Affected Versions: Accept Donations with PayPal WordPress plugin versions prior to 1.3.1 Description: The issue is related to a lack of CSRF check in the process of creating new donation buttons, which are internally treated as posts. This allows an attacker to...