CVE-2023-5982

The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instanceid on the 'updraftmethod-googledrive-auth' acti...

CVE-2023-46253

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

Design/Logic Flaw

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

CVE-2023-46253 Remote code execution in Squidex

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

CVE-2023-46253 Remote code execution in Squidex

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

CVE-2023-46253 Remote code execution in Squidex

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

PT-2023-29933 · Squidex · Squidex

Name of the Vulnerable Software and Affected Versions: Squidex versions affected versions not specified Description: The issue concerns an arbitrary file write vulnerability in the backup restore feature of Squidex, allowing an authenticated attacker with the squidex.admin.restore permission to...

squidex path traversal vulnerability

squidex is a Headless CMS and Content Management Center. A path traversal vulnerability exists in squidex version 7.8.2, which stems from an arbitrary file write vulnerability in the backup restore feature...

Fedora 39 : borgbackup (2023-467632ecbe)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-467632ecbe advisory. fix for CVE-2023-36811: spoofed archive leads to data loss Please note that starting with borgbackup 1.2.5 all borg repos must use TAM authentication:...

WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update

Description The plugin does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings. PoC fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded; charset=UTF-8", , "body":...

How to Back Up Virtual Machine Metadata to a USB Device

When migrating a set of Virtual Machines VMs from one XenServer host or pool to another, it is necessary to back up and then restore the Virtual Machine Metadata. It is recommended that the Virtual Machine Metadata be stored on the same Storage Repository as the Virtual Machines. But, it is also...

WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks. This was partially fixed in version 1.4.4 but it still allowed XSS attacks from Admin users. fetch"/wp-admin/admin-ajax.php",...

WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update

Description The plugin does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings. fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded; charset=UTF-8", , "body":...

WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks. This was partially fixed in version 1.4.4 but it still allowed XSS attacks from Admin users. PoC fetch"/wp-admin/admin-ajax.php",...

CVE-2023-36620

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is...

CVE-2023-36620

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is...

CVE-2023-36620

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is...

Design/Logic Flaw

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is...

Boomerang Parental Control Security Vulnerability

Boomerang Parental Control is an application from Boomerang that is used by parents to regulate their children's use of electronic devices. A security vulnerability exists in the Boomerang Parental Control application prior to version 13.83 Android, which stems from the application's lack of the...

CVE-2023-36620

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is...