WordPress 插件跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Contact Form 7 Database...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Contact Form 7 Database Addon CFDB7...

PT-2021-21395 · WordPress · Contact Form 7 Database Addon

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1 Description: The issue is related to an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. Recommendations: For versions = 1.2.6.1, update to a version high...

PT-2021-21396 · WordPress · Contact Form 7 Database Addon – Cfdb7

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9 Description: A Cross-Site Request Forgery CSRF issue was found in the Contact Form 7 Database Addon – CFDB7 WordPress plugin. This type of issue allows an attacker to...

CVE-2021-36885: Improper Neutralization of Input During Web Page Generation

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1...

CVE-2021-36886: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...

CVE-2021-45099

The addon.stdin service in addon-ssh aka Home Assistant Community Add-on: SSH & Web Terminal before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against...

CVE-2021-45099

The addon.stdin service in addon-ssh aka Home Assistant Community Add-on: SSH & Web Terminal before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against...

CVE-2021-45099

The addon.stdin service in addon-ssh aka Home Assistant Community Add-on: SSH & Web Terminal before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against...

CVE-2021-45099

The addon.stdin service in addon-ssh aka Home Assistant Community Add-on: SSH & Web Terminal before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against...

CVE-2021-45099

The vulnerability concerns the Home Assistant Community Add-on: SSH & Web Terminal (addon-ssh) prior to version 10.0.0 via the addon.stdin service. Root cause per sources is an attack surface that relies on social engineering; the vendor disputes this as a vulnerability, and addon.stdin was remov...

WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Ex.Mi Patchstack in WordPress Contact Form 7 Database Addon – CFDB7 plugin versions = 1.2.5.9. Solution Update the WordPress Contact Form 7 Database Addon – CFDB7 plugin to the latest available version at least 1.2.6.1...

oscap-anaconda-addon bug fix and enhancement update

An update is available for oscap-anaconda-addon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Roc...

CVE-2021-34362

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Med...

The vulnerability of the Media Streaming add-on, a multimedia file streaming application, and the Multimedia Console console lies in the lack of protection for the SQL query structure. This allows attackers to execute arbitrary SQL queries.

The vulnerability of the Media Streaming add-on, a multimedia file streaming application, and the Multimedia Console console is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries remote...

Cross-site Scripting (XSS) - Stored in boxbilling/boxbilling

Description Stored XSS at parameter 'iconurl' when Create New Product, New Category or New Addon Proof of Concept // PoC.req POST /BoxBilling/src/index.php?url=/api/admin/product/update HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:94.0 Gecko/20100101...

Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution Exploit

Moodle versions 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12, and earlier unsupported versions allow for a teacher to exploit chain to remote code execution. A bug in the privileges system allows a teacher to add themselves as a manager to their own class. They can then add any other users, and...

WordPress 插件跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. Countdown and CountUp WooCommerce Sales Timer...

CVE-2021-24660

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode...

CVE-2021-24661

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID...