WordPress plugin Webflow Pages 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Cybercriminals Use Webflow to Deceive Users into Sharing Sensitive Login Credentials

Cybersecurity researchers have warned of a spike in phishing pages created using a website builder tool called Webflow, as threat actors continue to abuse legitimate services like Cloudflare and Microsoft Sway to their advantage. "The campaigns target sensitive information from different crypto...

org.apereo.cas:cas-server-support-rest-x509 (>=6.5.0 <=6.6.15.2), org.apereo.cas:cas-server-support-x509 (>=6.5.0 <=6.6.15.2) +1 more potentially affected by CVE-2023-28857 via org.apereo.cas:cas-server-support-x509-core (>=6.5.0 <=6.6.5)

org.apereo.cas:cas-server-support-x509-core MAVEN version =6.5.0, =6.5.0, =6.5.0, =6.5.0, =6.6.15.2 Source cves: CVE-2023-28857 Source advisory: OSV:GHSA-P78H-M8PV-G9GM...

CVE-2024-34689

WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of th...

CVE-2024-34689

WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of th...

CVE-2024-34689 [CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)

WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of th...

RHEL 7 : spring-webflow (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spring-webflow: Data Binding Expression Vulnerability in Spring Web Flow CVE-2017-8039 - An issue was...

Webflow Pages <= 1.0.8 - Missing Authorization

Description The Webflow Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to perform an unauthorized action...

WordPress Webflow Pages Plugin <= 1.0.8 is vulnerable to Broken Access Control

Software Webflow Pages Type Plugin Vulnerable versions = 1.0.8 Fixed in 1.1.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49818 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f0a2c4f0050b Credits Mika Required privilege...

com.github.gfernandez598:springwebflow-optforrepl (=1.0), com.github.stephanarts:cas-server-integration-zeromq (>=0.0.1 <=0.0.8) +443 more potentially affected by CVE-2017-8039 via org.springframework.webflow:spring-webflow (>=2.0.6.RELEASE <=2.4.5.RELEASE)

org.springframework.webflow:spring-webflow MAVEN version =2.0.6.RELEASE, =0.0.1, =1.0, =1.0.0.RELEASE, =1.0, =1.0, =1.0.0-GA, =1.0.0-GA, =1.0.0-GA, =1.0.0-GA, =1.0.0-RC1 and more Source cves: CVE-2017-8039 Source advisory: OSV:GHSA-Q4V9-QJMW-J7VF...

com.github.gfernandez598:springwebflow-optforrepl (=1.0), fr.natsystem.natjet:natsys-nsworkflow (=7.0.19) +295 more potentially affected by CVE-2017-4971 via org.springframework.webflow:spring-webflow (>=2.4.0.RELEASE <=2.4.4.RELEASE)

org.springframework.webflow:spring-webflow MAVEN version =2.4.0.RELEASE, =1.0.0.RELEASE, =1.0, =1.0, =2.0.0-RC1, =2.0.0-RC1, =2.0.0-RC1, =2.0.0-RC1, =2.0.0-RC1, =5.0.0, =5.0.0, =5.1.9 and more Source cves: CVE-2017-4971 Source advisory: OSV:GHSA-FG9W-CFFM-PMH2...

berkano:bean-displaytag (>=20050615.234814 <=20050616.015551), berkano:berkano-util (>=20050725.114415 <=dev-20050723) +28 more potentially affected by CVE-2007-4556 via opensymphony:xwork (>=1.0.3 <=1.2.2)

opensymphony:xwork MAVEN version =1.0.3, =20050615.234814, =20050725.114415, =2.1.5, =1.1.3, =1.0-alpha-1, =1.1-beta-1, =1.1-beta-1, =1.0-beta-2, =1.0-beta-3 - org.codehaus.jet:jet-web-engine =1.0-beta-2 and more Source cves: CVE-2007-4556 Source advisory: OSV:GHSA-H7MF-QRM9-2848...

com.google.code.struts2webflow:struts2webflow-parent (=1.0.4), com.google.code.struts2webflow:struts2webflow-plugin (=1.0.4) +23 more potentially affected by CVE-2007-4556 via opensymphony:xwork (>=2.0.0 <=2.0.3)

opensymphony:xwork MAVEN version =2.0.0, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =2.0.5, =2.0.8 and more Source cves: CVE-2007-4556 Source advisory: OSV:GHSA-H7MF-QRM9-2848...

gnome-software and fwupd security, bug fix, and enhancement update

appstream-data 8-20200724 - Regenerate the RHEL metadata to include the EPEL apps too - Resolves: 1844488 8-20200630 - Regenerate the RHEL metadata - Resolves: 1844488 fwupd 1.4.2-4.0.1 - Build with the updated Oracle certificate - Use oraclesecureboot301 as certdir Orabug: 29881368 - Use new...

Acronis: Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services

Hi Team, Greetings! I've come across another subdomainwww.jet.acronis.com of acronis.com pointing to an unclaimed Webflow service. Visiting the www.jet.acronis.com returned the default 404 page for Webflow service, thereby making it potential for subdomain takeover. F940499 Similar to the previou...

Acronis: Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow services

Hi Team, Greetings! I've come across jet.acronis.com of acronis.com pointing to an unclaimed Webflow service. Visiting the jet.acronis.com returned the default 404 page for Webflow service, thereby making it potential for subdomain takeover. F937948 jet.acronis.com CNAME pointed to...

Takeover v0.2 - Sub-Domain TakeOver Vulnerability Scanner

Sub-domain takeover vulnerability occur when a sub-domain subdomain.example.com is pointing to a service e.g: GitHub , AWS/S3 ,.. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that sub-domain. For example, if...

Data Binding Expression Vulnerability

spring-webflow is vulnerable to a data binding expression vulnerability. The vulnerability is caused when the MvcViewFactoryCreator useSpringBinding property is set to false by default. Therefore, applications which use the default settings are vulnerable to malicious EL expressions in view state...

Spring WebFlow remote code execution vulnerability analysis(CVE-2017-4971)-vulnerability warning-the black bar safety net

In order to better and the majority of security enthusiasts, we build a community, the community mainly focused on the threats found and security data analysis and other fields, we hope to have more friends to join, together with the analysis of knowledge and common progress. Community address: ,...

CVE-2017-4971: Spring WebFlow remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

Spring severe of these vulnerabilities have traditionally not too much, before the more serious that problem is Spring's JavaBean automatic binding function, the result can be control class, which can lead to the use of certain characteristics of the execution of arbitrary code, but that...