CVE-2022-1967

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it coul...

Cross site scripting

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it coul...

CVE-2022-1967

The CVE-2022-1967 entry concerns the WordPress WP Championship plugin prior to version 9.3, where missing CSRF checks allow an authenticated admin to perform unintended actions (e.g., create/delete teams, update settings) and may enable Stored XSS due to inadequate sanitisation/escaping. Multiple...

CVE-2022-1967 WP Championship < 9.3 - Multiple CSRF

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it coul...

U.S. Dept Of Defense: SSRF ACCESS AWS METADATA - █████

Hi Security Team, Based on https://hackerone.com/hack-us-h1c challenge, I have urgent vulnerability and the challenge doesn't accept reprots for now 1:56 AM . I have found a SSRF Vulnerability which allow access to the AWS metadata, using Parameter ?url= as shown blew An attacker can tunnel into...

CVE-2022-23720 PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID...

CVE-2022-33313

Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33314

Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

U.S. Dept Of Defense: Stored XSS at https://█████

Description: In registeration page https://████ , first name and last name field are vulnerable to Stored Cross Site Scripting. Proof of concept For the fastly test, use this credentials to login my test account email: █████████ password: ██████ After login , alert document.cookie will triggered...

Jorani Cross-Site Request Forgery Vulnerability

Jorani is a leave management system. Designed to provide small organizations with a simple workflow for leave and overtime requests. A cross-site request forgery vulnerability exists in Jorani version 1.0, which stems from the /application/controllers/Users.php page not adequately verifying that ...

Exemys RME1 授权问题漏洞

The Exemys RME1 is an analog acquisition module with multiple communication protocols from Exemys Argentina. An authorization issue vulnerability exists in the Exemys RME1 that originates from bypassing the authentication scheme and performing administrative operations by using a specific...

Patchable and Preventable Security Issues Lead Causes of Q1 Attacks

Eighty-two percent of attacks on organizations in Q1 2022 were caused by the external exposure of a known vulnerabilities in the victim’s external-facing perimeter or attack surface. Those unpatched bugs overshadowed breach-related financial losses tied to human error, which accounted for 18...

UBUNTU-CVE-2022-31108

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

Atlassian Jira Seraph Authentication Bypass

Atlassian Jira versions 8.13.18, 8.14.x, 8.15.x, 8.16.x, 8.17.x, 8.18.x, 8.19.x, 8.20.x 8.20.6, 8.21.x and Atlassian Jira Service Management versions 4.13.18, 4.14.x, 4.15.x, 4.16.x, 4.17.x, 4.18.x, 4.19.x, 4.20.x 4.20.6 and 4.21.x use a common authentication framework named Atlassian Jira Seraph...

Remote Code Execution (RCE)

aamiles is vulnerable to remote code execution. The use of the request package opens up a code execution backdoor, allowing an attacker to perform unauthorized actions and accesses to sensitive information and digital currency keys...

CVE-2022-1845

The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks...

CVE-2022-1845

The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks...

Remote Code Execution Backdoor

zibal is vulnerable to remote code execution. The use of the request package opens up a code execution backdoor, allowing an attacker to perform unauthorized actions and accesses to sensitive information and digital currency keys...

Remote Code Execution Backdoor

cloudlabeling is vulnerable to remote code execution. The use of the request package opens up a code execution backdoor, allowing an attacker to perform unauthorized actions and accesses to sensitive information and digital currency keys...

Remote Code Execution Backdoor

beginner is vulnerable to remote code execution. The use of the request package opens up a code execution backdoor,allowing an attacker to perform unauthorized actions and accesses to sensitive information and digital currency keys...