WordPress Plugin Current Book 1.0.1 - 'Book Title' Persistent Cross-Site Scripting

Exploit Title: WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting XSS Date: 14/07/2021 Exploit Author: Vikas Srivastava Vendor Homepage: Software Link: https://wordpress.org/plugins/current-book/ Version: 1.0.1 Category: Web Application How to Reproduc...

Microsoft Windows Multiple Vulnerabilities (KB5004249)

This host is missing a critical security update according to Microsoft KB5004249 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. 1. Install WordPress 5.7.2 2. Install and activate Custom Book 3...

WordPress Current Book plugin <= 1.0.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Vikas Srivastava in WordPress Current Book plugin versions = 1.0.1. Solution This plugin has been closed as of July 15, 2021 and is not available for download. This closure is temporary, pending a full review...

Windows Address Book Remote Code Execution Vulnerability

...

The vulnerability of the microprogrammed software of Western Digital’s WD My Book Live and WD My Book Live Duo storage devices arises from the failure to eliminate the special components used in the operating system commands. This vulnerability allows a perpetrator to execute arbitrary commands.

The vulnerability of the microprogrammed software for Western Digital WD My Book Live and WD My Book Live Duo exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute...

PT-2021-6042 · Microsoft · Windows Address Book +1

Name of the Vulnerable Software and Affected Versions: Windows Address Book affected versions not specified Description: The issue is related to errors in code generation management in the Windows Address Book of Windows operating systems. It allows a remote attacker to execute arbitrary code in...

Microsoft Windows Address Book 代码注入漏洞

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. A remote code execution vulnerability exists in Windows Address Book in Microsof...

KLA12221 Multiple vulnerabillities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, gain privileges, bypass security restrictions, obtain sensitive information, spoof user interface. Below is a complete list of...

The vulnerability of Western Digital WD My Book Live and WD My Book Live Duo disk storage devices stems from authentication procedures that have flaws. This allows attackers to reset the device to its factory settings.

The vulnerability of the microprogrammed software in Western Digital WD My Book Live and WD My Book Live Duo storage devices is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Mccms has a file upload vulnerability

Mccms is a comic + novel system developed using the Ci framework as its core. Mccms has a file upload vulnerability that can be exploited by attackers to gain control of the server...

Mccms has a flawed logic vulnerability

Mccms is a comic + novel system developed using the Ci framework as its core. Mccms has a logic flaw vulnerability that can be exploited by attackers to modify the payment amount...

Episode 124: PrintNightmare 0Day Exploit Accidentally Leaked Online

Security researchers accidentally leaked zero-day exploit code for a new Windows bug, now called PrintNightmare, while easily exploitable vulnerabilities in the ProfilePress plugin, previously called WP User Avatar, were patched quickly. An unprotected cloud database containing over 814 million...

Western Digital My Book Live End of Life (EOL) Detection

The remote Western Digital My Book Live device has reached the End of Life EOL / End of Updates EOU and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Western Digital WD My Book Live Operating System Command Injection Vulnerability

Western Digital WD My Book Live is a network storage device from Western Digital. An operating system command injection vulnerability exists in all versions of Western Digital WD My Book Live. A remote attacker could exploit this vulnerability to execute commands...

Trader orders can be frontrun and users can be denied from trading

Handle cmichel Vulnerability details The Trader contract accepts two signed orders and tries to match them. Once they are matched and become filled, they can therefore not be matched against other orders anymore. This allows for a griefing attack where an attacker can deny any other user from...

Unspecified Vulnerability in Western Digital WD My Book Live

Western Digital WD My Book Live is a network storage device from Western Digital. A security vulnerability exists in Western Digital WD My Book Live 2.x and earlier versions and WD My Book Live Duo, which stems from the fact that the products have an administrator API that can be exploited by an...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

Authentication flaw

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...