CVE-2022-38093 WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities in All in One SEO plugin = 4.2.3.1 at WordPress...

CVE-2022-38093 WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities in All in One SEO plugin = 4.2.3.1 at WordPress...

zvykacky.cz Cross Site Scripting vulnerability OBB-2906274

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-24197 · WordPress · All In One Seo

Name of the Vulnerable Software and Affected Versions: All in One SEO plugin versions prior to 4.2.3.1 Description: The issue concerns multiple Cross-Site Request Forgery CSRF vulnerabilities. CSRF is a type of attack where an attacker tricks a user into performing unintended actions on a web...

Windows shellcode stage, Reverse All-Port TCP Stager

Custom shellcode stage. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options msf use payload/windows/custom/reversetcpallports msf payloadreversetcpallports show actions ...actions... msf payloadreversetcpallports set ACTION msf payloadreversetcpallports show...

Server side request forgery (ssrf)

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

CVE-2022-2633

CVE-2022-2633 affects the WordPress All-In-One Video Gallery plugin (versions up to 2.6.0). The root cause is improper handling of the dl parameter in ~/public/video.php, enabling unauthenticated arbitrary file downloads and server-side request forgery (SSRF). Impact is unauthenticated access to ...

PT-2022-17789 · WordPress · All-In-One Video Gallery

Name of the Vulnerable Software and Affected Versions: All-in-One Video Gallery plugin for WordPress versions up to, and including 2.6.0 Description: The issue allows unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server via the dl...

CVE-2022-38367

The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all users from Jira by making an HTTP request to the affected endpoint...

WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Rafie Muhammad aka Yeraisci Patchstack Alliance in The WordPress All in One SEO plugin versions = 4.2.3.1. Solution Update the WordPress All In One SEO Pack plugin to the latest available version at least 4.2.4...

WordPress All-in-One WP Migration 7.64 plugin - Unauthenticated Backup Download Exploit

Title: All-in-One-WP-Migration-7.64 low-protection-file-disclosure - Unauthenticated Backup Download Author: nu11secur1ty Date: 09.01.2022 Vendor: https://servmask.com/ Software: https://wordpress.org/plugins/all-in-one-wp-migration/ Reference:...

Atlassian Jira 安全漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage various types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira versions prior to 2.0.6 that stems from the Netic User Export plugi...

CVE-2022-36638

An access control issue in the component print.php of Garage Management System v1.0 allows unauthenticated attackers to access data for all existing orders...

ManageEngine ADAudit Plus Xnode Enumeration

This module exploits default admin credentials for the DataEngine Xnode server in ADAudit Plus versions prior to 6.0.3 6032 in order to dump the contents of Xnode data repositories tables, which may contain a limited amount of Active Directory information including domain names, host names,...

CVE-2022-2896

Measuresoft ScadaPro Server All Versions allows use after free while processing a specific project file...

CVE-2022-2897

CVE-2022-2897 affects Measuresoft ScadaPro Server and Client (all versions). The issue is improper link resolution before file access (link following) that can lead to local privilege escalation. Public sources describe a local attack requiring initial code execution by a low-privileged user, wit...

CVE-2022-2896 Measuresoft ScadaPro Server Use After Free

Measuresoft ScadaPro Server All Versions allows use after free while processing a specific project file...

CVE-2022-2898

CVE-2022-2898 affects Measuresoft ScadaPro Server and Client (All Versions). The issue is improper link resolution before file access (Link Following), leading to a Denial-of-Service condition. Exploitation in public advisories indicates a local attacker with low privileges may abuse the ScadaPro...

CVE-2022-2638

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server...

CVE-2022-2638

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server...