384 matches found
scap-security-guide bug fix and enhancement update
The scap-security-guide project provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol SCAP format and constitutes a catalog of practical hardening advice, linked to government...
CVE-2021-24808
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise with sanitizetextfield but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
Cross site request forgery (csrf)
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bpbettermessagesleavechat, bpbettermessagesjoinchat, bpmessagesleavethread, bpmessagesmutethread, bpmessagesunmutethread, bpbettermessagesaddusertothread,...
CVE-2021-24809
Affected software: WordPress BP Better Messages plugin. Vulnerability: Cross-Site Request Forgery (CSRF) in multiple AJAX actions (bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user...
CVE-2021-24808 BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise with sanitizetextfield but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24808
The CVE-2021-24808 entry describes a Reflective Cross-Site Scripting in the BP Better Messages WordPress plugin prior to version 1.9.9.41. Root cause: the plugin sanitises the subject via sanitize_text_field but fails to escape it when outputting back into an HTML attribute, enabling attack strin...
PT-2021-16302
Name of the Vulnerable Software and Affected Versions: BP Better Messages WordPress plugin versions prior to 1.9.9.41 Description: The issue concerns the lack of CSRF checks in multiple AJAX actions within the plugin. Specifically, the affected actions include bp better messages leave chat, bp...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin BP Better Messages prior to...
PT-2021-16301
Name of the Vulnerable Software and Affected Versions: BP Better Messages WordPress plugin versions prior to 1.9.9.41 Description: The issue arises from the plugin's failure to properly escape the subject parameter after sanitization, leading to a Reflected Cross-Site Scripting issue. This occurs...
CVE-2021-24808: Improper Neutralization of Input During Web Page Generation
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise with sanitizetextfield but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24809: Cross-Site Request Forgery (CSRF)
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bpbettermessagesleavechat, bpbettermessagesjoinchat, bpmessagesleavethread, bpmessagesmutethread, bpmessagesunmutethread, bpbettermessagesaddusertothread,...
bp-automotive.com Improper Access Control vulnerability OBB-2200671
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress BP Better Messages plugin <= 1.9.9.37 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Brandon Roldan in WordPress BP Better Messages plugin versions = 1.9.9.37. Solution Update the WordPress BP Better Messages plugin to the latest available version or at least to the version 1.9.9.41...
WordPress BP Better Messages plugin <= 1.9.9.37 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability discovered by Brandon Roldan in WordPress BP Better Messages plugin versions = 1.9.9.37. Solution Update the WordPress BP Better Messages plugin to the latest available version or at least to the version 1.9.9.41...
BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting
The plugin sanitise with sanitizetextfield but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue https://example.com/chat-rooms/?subject=asd%22%20%22%20onmouseover=javascript:alert1;%20test=%22&new-message=asd...
bp-electricite.com Cross Site Scripting vulnerability OBB-2137072
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
SQL Injection Vulnerability in Miku cms bp***.php Page
Miku cms is a website building management system. A SQL injection vulnerability exists in the Miku cms bp.php page, which can be exploited by attackers to obtain sensitive information from the database...
SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:2776-1)
The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.155 to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-13093: Prevent NULL pointer dereference and panic in lookupslow on a NULL inode-iops pointer when doing pathwalks on a corrupted xfs image. Th...
CVE-2018-13094
An issue was discovered in fs/xfs/libxfs/xfsattrleaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfsdashrinkinode is called with a NULL bp...
Unbreakable Enterprise kernel security update
2.6.39-400.298.7 - net/rds: Fix endless RNR situation Hakon Bugge Orabug: 27645402 - x86/entry/64: Dont use IST entry for BP stack Andy Lutomirski CVE-2018-8897...