CVE-2021-24572

The CVE-2021-24572 entry affects the WordPress plugin Accept Donations with PayPal (versions before 1.3.1). The root cause is a CSRF vulnerability in the donation button management function where posts are used to store buttons, and there is no validation to confirm the target post type when dele...

CVE-2021-24570

The CVE-2021-24570 vulnerability affects the WordPress plugin Accept Donations with PayPal up to version 1.3.1. The issue arises from a missing CSRF check in the process that creates donation buttons (which are stored as posts), enabling an authenticated admin to create new buttons. Additionally,...

WordPress plugin Accept Donations with PayPal 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

CVE-2021-24572: Cross-Site Request Forgery (CSRF)

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could...

PT-2021-16089

Name of the Vulnerable Software and Affected Versions Accept Donations with PayPal WordPress plugin versions prior to 1.3.1 Description The issue arises from the lack of CSRF protection when deleting donation buttons, which are stored as posts. This allows an attacker to trick logged-in admins in...

CVE-2021-24570: Cross-Site Request Forgery (CSRF)

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of t...

CVE-2021-21682

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows...

WordPress Accept Donations with PayPal plugin <= 1.3 - Cross-Site Request Forgery (CSRF) leading to Arbitrary Post Deletion

Cross-Site Request Forgery CSRF leading to Arbitrary Post Deletion discovered by dc11 in WordPress Accept Donations with PayPal plugin versions = 1.3. Solution Update the WordPress Accept Donations with PayPal plugin to the latest available version at least 1.3.1...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

The vulnerability of the regular expression processor in the Mime-type parser of the ActionDispatch framework in the Ruby programming platform of Ruby on Rails, related to an uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the regular expression processor in the Mime-type parser of the ActionDispatch framework in the Ruby programming platform’s Ruby on Rails framework is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service...

Charity Management System CMS 1.0 - Multiple Vulnerabilities

Exploit Title: Charity Management System CMS 1.0 - Multiple Vulnerabilities Date: 18/08/2021 Exploit Author: Davide 't0rt3ll1n0' Taraschi Vendor Homepage: https://www.sourcecodester.com/users/tips23 Software Link:...

OPENSUSE-SU-2021:1125-1 Security update for aria2

This update for aria2 fixes the following issues: Update to version 1.35.0: Drop SSLv3.0 and TLSv1.0 and add TLSv1.3 TLSv1.3 support is added for GNUTLS and OpenSSL. Platform: Fix compilation without deprecated OpenSSL APIs Remove linux getrandom and use C++ stdlib instead Don't send Accept...

CVE-2021-37625

Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket causes an early exit from the run loop that should continue infinitely unless terminated by a local user...

PT-2021-21741

Name of the Vulnerable Software and Affected Versions Skytable versions prior to 0.6.4 Description The issue is related to an incorrect check of the return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket, causing an early exit from the run loop. This...

CVE-2020-11511: Missing Authorization

The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter...

PT-2021-9421 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress plugin versions prior to 3.2.6.9 for WordPress Description: The issue allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter. Recommendations: For versions prio...

Linux/x86 - Bind (User Specified Port) Shell (/bin/sh) Shellcode (102 bytes)

Exploit Title: Linux/x86 - Bind User Specified Port Shell /bin/sh Shellcode 102 bytes Exploit Author: d7x Tested on: Ubuntu x86 / Linux/x86 Bind Shell /bin/sh with dynamic port binding Null-Free Shellcode 102 bytes Usage: gcc -z execstack -o bindshell bindshell.c ./bindshell 7000 Binding to 7000...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...