270 matches found
CVE-2021-24918
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...
CVE-2021-24918
CVE-2021-24918 affects the WordPress plugin Smash Balloon Social Post Feed (versions before 4.0.1). The root cause is missing privilege and nonce validation when saving plugin settings, allowing any logged-in user on a vulnerable site to update settings and store rogue JavaScript on posts and pag...
CVE-2021-24918 Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...
PT-2021-16367
Name of the Vulnerable Software and Affected Versions: Smash Balloon Social Post Feed WordPress plugin versions prior to 4.0.1 Description: The issue allows any logged-in user on a vulnerable site to update the plugin's settings without proper privilege or nonce validation. This enables the stora...
WordPress 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress Plugin is a WordPress open source application plugin. WordPress Smash Balloon Social Post Feed...
Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
The plugin did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...
GSD-2021-1001746 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...
UVI-2021-1001746 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.9 by commit...
UVI-2021-1001665 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.70 by commit...
GSD-2021-1001665 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.70 by commit...
GSD-2021-1001608 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.150 by commit...
UVI-2021-1001608 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.150 by commit...
UVI-2021-1001571 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.209 by commit...
GSD-2021-1001571 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.209 by commit...
UVI-2021-1001543 xen/balloon: use a kernel thread instead a workqueue
xen/balloon: use a kernel thread instead a workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.249 by commit...
WordPress Smash Balloon Social Post Feed Plugin < 2.19.2 XSS Vulnerability
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
CVE-2021-24508
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an...
CVE-2021-24508
The issue CVE-2021-24508 concerns the Smash Balloon Social Post Feed WordPress plugin prior to version 2.19.2. The vulnerability arises because the feed_locator AJAX action does not sanitize or escape the POST parameter feedID, and the truncated value is output in the admin dashboard. This leads ...
WordPress 插件跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Smash Balloon Social Post Feed, which...
WordPress Smash Balloon Social Post Feed plugin <= 2.19.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by dc11 in WordPress Smash Balloon Social Post Feed plugin versions = 2.19.1. Solution Update the WordPress Smash Balloon Social Post Feed plugin to the latest available version at least 2.19.2...