CVE-2024-50523 WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through = 1.8.2...

CVE-2024-50523

The CVE-2024-50523 entry documents an Unrestricted Upload of File with Dangerous Type vulnerability in the WordPress plugin All Post Contact Form, allowing an unauthenticated attacker to upload a web shell to the target server. Affected versions include

WordPress plugin All Post Contact Form 代码问题漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2024-34300 · Unknown · All Post Contact Form

Name of the Vulnerable Software and Affected Versions: All Post Contact Form versions 1.7.3 and earlier Description: The issue affects the All Post Contact Form, allowing an unrestricted upload of files with dangerous types, such as a web shell, to a web server. This enables attackers to compromi...

SUSE CVE-2024-47825

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin All Post Contact Form versions = 1.8.2...

CVE-2024-42041

The com.videodownload.browser.videodownloader aka AppTool-Browser-Video All Video Downloader application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component...

WordPress All Post Contact Form Plugin <= 1.7.8 is vulnerable to Arbitrary File Upload

Software All Post Contact Form Type Plugin Vulnerable versions = 1.7.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50523 Patch priority High CVSS severity High 10 Developer Claim ownership PSID f181d8f37094 Credits stealthcopter Required privilege...

GHSA-C4Q5-6C82-3QPW Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: It must be a WebFlux application It must be using Spring's static resources support It...

WordPress All-in-One WP Migration and Backup plugin <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection vulnerability

Authenticated Administrator+ Arbitrary PHP Code Injection vulnerability discovered by Ryan Kozak in WordPress Plugin All-in-One WP Migration versions = 7.86...

WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to PHP Object Injection

Software All-in-One WP Migration Type Plugin Vulnerable versions = 7.86 Fixed in 7.87 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-9162 Patch priority Low CVSS severity Low 7.2 Developer ServMask, Inc PSID 44c4c1ddd033 Credits Ryan Kozak Required privilege...

WordPress plugin All-in-One WP Migration and Backup 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code injection vulnerability exis...

PT-2024-10801 · Useragent · Useragent

Name of the Vulnerable Software and Affected Versions: Useragent versions prior to a fixed version no fixed version specified Description: The issue concerns a Regular Expression Denial of Service ReDoS vulnerability in the Useragent user agent parser for Node.js. This vulnerability affects all...

PT-2024-10795 · Unknown · Commonregexjs

Name of the Vulnerable Software and Affected Versions: CommonRegexJS versions all available versions Description: The issue concerns Regular Expression Denial of Service ReDoS due to vulnerable regular expressions in CommonRegexJS. No known patches are available as of the time of publication...

October 24, 2024—KB5044384 (OS Build 26100.2161) Preview

None None...

Announcing the BlueHat 2024 Sessions

34 sessions from 54 presenters representing 20 organizations! We are thrilled to reveal the lineup of speakers and presentations for the 23rd BlueHat Security Conference, in Redmond WA from Oct 29-30. This year's conference continues the BlueHat ethos and Secure Future Initiative mission of...

CVE-2024-8852

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full...

CVE-2024-8852

The CVE-2024-8852 entry concerns the All-in-One WP Migration and Backup plugin for WordPress. Affected versions are up to and including 7.86 (per NVD/WP sources) with unauthenticated information disclosure due to publicly accessible error.log files or log data, enabling disclosure of potentially ...

PT-2024-39276

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration and Backup plugin for WordPress versions up to, and including, 7.86 Description: The issue allows unauthenticated attackers to view potentially sensitive information, such as full paths, contained in publicly exposed l...

WordPress plugin All-in-One WP Migration and Backup 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...