CVE-2022-27851

Cross-Site Request Forgery CSRF in Use Any Font WordPress plugin = 6.1.7 allows an attacker to deactivate the API key...

CVE-2022-27851

Cross-Site Request Forgery CSRF in Use Any Font WordPress plugin = 6.1.7 allows an attacker to deactivate the API key...

CVE-2022-27851

The CVE-2022-27851 entry concerns a CSRF vulnerability in the WordPress plugin Use Any Font, versions up to 6.1.7, that allows an attacker to deactivate the API key. Root cause: missing CSRF protection on the API key deactivation action. Impact: an attacker could cause a admin user to deactivate ...

CVE-2022-27851 WordPress Use Any Font plugin <= 6.1.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF in Use Any Font WordPress plugin = 6.1.7 allows an attacker to deactivate the API key...

WordPress插件 Use Any Font跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Use Any Font 6.1.7 and its...

CVE-2022-27851

Cross-Site Request Forgery CSRF in Use Any Font WordPress plugin = 6.1.7 allows an attacker to deactivate the API key...

WordPress Use Any Font plugin <= 6.1.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability was discovered by Rasi Afeef Patchstack Alliance in WordPress Use Any Font plugin versions = 6.1.7. Solution Update the WordPress Use Any Font plugin to the latest available version at least 6.1.8...

Halo 跨站脚本漏洞

Halo is a personal blogging system for individual developers. A security vulnerability exists in Halo 1.4.14, which stems from the fact that the function point for uploading an avatar can upload any file, such as uploading an HTML file. No details of the vulnerability are provided at this time...

Improper Certificate Validation

Overview kubeclient is a client for Kubernetes REST API. Affected versions of this package are vulnerable to Improper Certificate Validation via the parsing process of kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any...

CVE-2022-24073

The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store...

CVE-2022-0959

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write...

CVE-2022-0757

Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in the SearchCriteria and inject SQL code...

CVE-2021-24977

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the...

Cross site scripting

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the...

CVE-2021-24977 Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the...

CVE-2021-24977

The CVE relates to the WordPress plugin Use Any Font | Custom Font Uploader, versions prior to 6.2.1. The root cause is missing authorization checks when assigning a font, which allows unauthenticated users to append arbitrary CSS that the frontend processes for all users. In addition, insufficie...

PT-2022-9543 · WordPress · Use Any Font | Custom Font Uploader

Name of the Vulnerable Software and Affected Versions: Use Any Font | Custom Font Uploader WordPress plugin versions prior to 6.2.1 Description: The issue allows unauthenticated users to send arbitrary CSS, which will be processed by the frontend for all users. This is due to the lack of...

WordPress "Any Popup – Popup Forms, Optins & Ads" plugin <= 1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Any Popup – Popup Forms, Optins & Ads" plugin versions = 1.0. Solution No patched version available...

CVE-2021-27796

A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment rbash as either the “user” or “factory” account, to read the contents of any file on the filesystem utilizing one of a few availabl...

BSA-2021-1721

Security Advisory ID : BSA-2021-1721 Component : shell Revision : 1.0 A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment rbash as either the “user” or “factory” account, to...