CVE-2022-4631 WP-Ban ban-options.php cross site scripting

A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 22b925449c84faa9b7496abe4f8f5661cb5eb3bf. ...

WP-Ban 跨站脚本漏洞

WP-Ban is a blog by Lester Chan, a personal developer that bans users from WordPress via IP, IP range, hostname, user agent and referring url. WP-Ban suffers from a security vulnerability that stems from an unknown function in its ban-options.php file that allows an attacker to implement cross-si...

CVE-2022-4631 WP-Ban ban-options.php cross site scripting

A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 22b925449c84faa9b7496abe4f8f5661cb5eb3bf. ...

CVE-2021-4252

A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function togglecheckbox of the file ban-options.php. The manipulation of the argument $SERVER"HTTPUSERAGENT" leads to cross site scripting. The attack may be initiated remotely. The name of the...

CVE-2021-4252

A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function togglecheckbox of the file ban-options.php. The manipulation of the argument $SERVER"HTTPUSERAGENT" leads to cross site scripting. The attack may be initiated remotely. The name of the...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function togglecheckbox of the file ban-options.php. The manipulation of the argument $SERVER"HTTPUSERAGENT" leads to cross site scripting. The attack may be initiated remotely. The name of the...

CVE-2021-4252 WP-Ban ban-options.php toggle_checkbox cross site scripting

A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function togglecheckbox of the file ban-options.php. The manipulation of the argument $SERVER"HTTPUSERAGENT" leads to cross site scripting. The attack may be initiated remotely. The name of the...

WP-Ban 安全漏洞

WP-Ban is a blog by Lester Chan, an individual developer, that bans users from accessing WordPress via IP, IP range, hostname, user agent, and referring url. A security vulnerability exists in WP-Ban, which stems from the manipulation of a parameter in the togglecheckbox function of its...

CVE-2021-4252 WP-Ban ban-options.php toggle_checkbox cross site scripting

A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function togglecheckbox of the file ban-options.php. The manipulation of the argument $SERVER"HTTPUSERAGENT" leads to cross site scripting. The attack may be initiated remotely. The name of the...

CVE-2021-4252

CVE-2021-4252 affects the WordPress WP-Ban plugin, specifically the function toggle_checkbox in ban-options.php. The issue arises from manipulating the request header value $_SERVER["HTTP_USER_AGENT"], enabling cross-site scripting. The vulnerability can potentially be initiated remotely. A patch...

PT-2022-11604 · WordPress · Wp-Ban

Name of the Vulnerable Software and Affected Versions: WP-Ban affected versions not specified Description: A problematic issue has been found in WP-Ban, affecting the toggle checkbox function of the file ban-options.php. The manipulation of the argument $ SERVER"HTTP USER AGENT" leads to cross-si...

BigBlueButton 访问控制错误漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton community. An access control error vulnerability exists in versions prior to BigBlueButton 2.4-rc-6 that stems from being subject to an invalid user ban, which could be exploited by an attacker to register multiple use...

WP-Ban < 1.69.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to the plugin settings and set these...

Cloudflare Public Bug Bounty: Using special IPv4-mapped IPv6 addresses to bypass local IP ban

Vulnerability description not provided...

U.S. Bans Chinese Telecom Equipment and Surveillance Cameras Over National Security Risk

The U.S. Federal Communications Commission FCC formally announced it will no longer authorize electronic equipment from Huawei, ZTE, Hytera, Hikvision, and Dahua, deeming them an "unacceptable" national security threat. All these Chinese telecom and video surveillance companies were previously...

VPN SNX portal may be vulnerable to brute-force attack on passwords

Cause The VPN SNX portal in the IPsec VPN Software Blade does not implement any protection against brute-force attack on usernames/passwords. Symptoms - The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for...

GHSA-C735-G9F2-2MVP Cross-Site Request Forgery in Jenkins

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlie...

Ad Invalid Click Protector (AICP) < 1.2.7 - Arbitrary Ban Deletion via CSRF

The plugin does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans https://example.com/wp-admin/admin.php?page=aicpbanneduserdetails&action=delete&id=1...

Ad Invalid Click Protector (AICP) < 1.2.7 - Arbitrary Ban Deletion via CSRF

The plugin does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans PoC https://example.com/wp-admin/admin.php?page=aicpbanneduserdetails=delete=1...

GHSA-J3FF-XP6C-6GCC Failure to validate signature during handshake

Impact @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Patches Users should upgrade to 4.1.2 or 5.0.3 Workarounds No workarounds, just patch...