Over 1 Million Sites Impacted by Vulnerability in Starter Templates Plugin

On October 4, 2021, the Wordfence Threat Intelligence team initiated the responsible disclosure process for the Starter Templates plugin, which is installed on over 1 Million WordPress websites. The full name of the WordPress plugin is “Starter Templates — Elementor, Gutenberg & Beaver Builder...

astra-spatravel.de Improper Access Control vulnerability OBB-2172696

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the Wine package on the Astra Linux (Orel) operating system relates to the display of external program windows over the Astra Linux (Orel) lock window, allowing a intruder to gain unauthorized access to confidential information.

The vulnerability of the Wine software on the Astra Linux operating system Orel relates to the display of modal windows of third-party programs such as “MediaLog” over the Astra Linux lock screen. Exploiting this vulnerability could allow a malicious individual to gain unauthorized access to...

WordPress Astra Pro Addon Plugin SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Astra Pro Addon Plugin versions prior to 3.5.2, which stems...

CVE-2021-24507

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an...

CVE-2021-24507

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an...

Sql injection

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an...

CVE-2021-24507

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an...

CVE-2021-24507 Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an...

CVE-2021-24507

The CVE-2021-24507 case concerns the Astra Pro Addon WordPress plugin prior to 3.5.2, where POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX actions were not properly sanitised/escaped before being used in SQL statements. This (server-side) vulnerability ...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Astra Pro Addon Plugin versions prior to 3.5.2, which stems...

WordPress Astra Pro premium plugin <= 3.5.1 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by Ngoc Nguyen in WordPress Astra Pro premium plugin versions = 3.5.1. Solution Update the WordPress Astra Pro premium plugin to the latest available version at least 3.5.2...

Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection

The plugin did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an SQL Injection issues PoC Via...

Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection

The plugin did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an SQL Injection issues Via...

The vulnerability of the `pdprl_get_from_raw_lbl` function in the Linux-astra-modules kernel module, related to improper memory release, allows a hacker to trigger a service failure.

The vulnerability of the pdprlgetfromrawlbl function in the linux-astra-modules kernel module is related to an improper check of the raw parameter. This leads to a slab-out-of-bounds error later on. Exploiting this vulnerability allows an attacker to cause service failures...

The vulnerability of the software for creating a private virtual network, astra-openvpn-server, related to integer overflows, allows a hacker to cause a service failure.

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to improperly defined variable boundaries. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the software for creating a private virtual network, astra-openvpn-server, related to code errors, allows a intruder to trigger a service failure.

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to a code error that prevents the /etc/openvpn/keys/ directory from being created. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the `parsec inode_post_xattr` function in the Linux kernel modules, related to improper memory release, allows a hacker to trigger a service failure.

The vulnerability of the parsec inodepostxattr function in the Linux-Astra-modules is related to a variable overflow, which subsequently leads to a null-ptr-deref error. Exploiting this vulnerability allows an attacker to cause service failures...

The vulnerability of the astra-safepolicy software for security configuration involves insufficient data processing within the security mechanisms, allowing attackers to trigger a service failure.

The vulnerability of the astra-safepolicy security configuration software is related to incorrect data processing in the /etc/fstab file. Exploiting this vulnerability allows an attacker to cause service failures...

The vulnerability of the astra-safepolicy software for security configuration settings, due to insufficient input validation, allows a perpetrator to trigger a service failure.

The vulnerability of the astra-safepolicy security configuration software is related to incorrect data processing in the stderr output. Exploiting this vulnerability allows a remote attacker to cause service failures...