CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2024-54240

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through = 1.3.3...

CVE-2024-54240

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through = 1.3.3...

CVE-2024-54240

CVE-2024-54240 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Blaze Online eParcel for WooCommerce, affecting versions 1.3.3 and earlier. It arises from improper input neutralization during page generation. Impact, as stated in sources, could allow injection of sc...

WordPress plugin Blaze Online eParcel for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2024-36119 · Woocommerce · Blaze Online Eparcel For Woocommerce

Name of the Vulnerable Software and Affected Versions: Blaze Online eParcel for WooCommerce versions 1.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

WordPress Blaze Online eParcel for WooCommerce plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Blaze Online eParcel for WooCommerce versions = 1.3.3...

WordPress BLAZE Retail Widget plugin <= 2.5.2 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin BLAZE Retail Widget versions = 2.5.2...

WordPress BLAZE Retail Widget Plugin <= 2.5.2 is vulnerable to Backdoor

Software BLAZE Retail Widget Type Plugin Vulnerable versions = 2.5.2 Fixed in 2.5.4 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a9f87b35d94a Credits Sansec.io Required privilege Unauthenticated Published 3 July...

WordPress BLAZE Retail Widget plugin 2.2.5 to 2.5.2 - Injected Backdoor vulnerability

Injected Backdoor vulnerability discovered by WordFence in WordPress Plugin BLAZE Retail Widget versions 2.2.5-2.5.2...

Multiple WordPress Plugins Compromised: Hackers Create Rogue Admin Accounts

Multiple WordPress plugins have been backdoored to inject malicious code that makes it possible to create rogue administrator accounts with the aim of performing arbitrary actions. "The injected malware attempts to create a new administrative user account and then sends those details back to the...

WordPress BLAZE Retail Widget Plugin 2.2.5-2.5.2 is vulnerable to Backdoor

Software BLAZE Retail Widget Type Plugin Vulnerable versions 2.2.5-2.5.2 Fixed in 2.5.4 OWASP Top 10 A3: Injection Classification Backdoor CVE CVE-2024-6297 Patch priority High CVSS severity High 10 Developer Claim ownership PSID b9aa7ce213ab Credits WordFence Required privilege Unauthenticated...

CVE-2024-37198

Cross-Site Request Forgery CSRF vulnerability in blazethemes Digital Newspaper.This issue affects Digital Newspaper: from n/a through 1.1.5...

This Week in Spring - December 13th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! I truly, absolutely, can not believe that were nearly done with the year already! Have you made your new years resolutions? Submitted your expense reports? Its that time of the year when Im going to start focusing on staying...

WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.12 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Nuno Correia Blaze Security in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.12. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...

CVE-2018-14719

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using blaze classes. An attacker could use this flaw to execute arbitrary code...

[Security Nation] Marina Ciavatta and int eighty Put the Fun into Hacking With Hacking Esports and Dual Core Music

!\Security Nation\ Marina Ciavatta and int eighty Put the Fun into Hacking With Hacking Esports and Dual Core Musichttps://blog.rapid7.com/content/images/2021/04/securitynationlogo-65.jpg In this episode of Security Nation, we are joined by Marina Ciavatta and int eighty to talk about Hacking...

Denial Of Service (DoS)

blaze-core is vulnerable to denial of service DoS. The vulnerability exists through the unbounded connection acceptance in the NIO1SocketServerGroup that leads to the exhaustion of file handles...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2021-21294

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...