WordPress plugin Comments Import & Export 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exists...

WordPress WordPress Comments Import & Export plugin <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal vulnerability

Authenticated Author+ Arbitrary File Read via Directory Traversal vulnerability discovered by scottaglia in WordPress Plugin Comments Import & Export versions = 2.3.7...

Cybercriminals Use Unicode to Hide Mongolian Skimmer in E-Commerce Platforms

Cybersecurity researchers have shed light on a new digital skimmer campaign that leverages Unicode obfuscation techniques to conceal a skimmer dubbed Mongolian Skimmer. "At first glance, the thing that stood out was the script's obfuscation, which seemed a bit bizarre because of all the accented...

WordPress WordPress Comments Import & Export Plugin <= 2.3.7 is vulnerable to Directory Traversal

Software WordPress Comments Import & Export Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.9 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-7514 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 06055d28d8b6 Credits scottaglia Required...

CVE-2024-47816 Users can impersonate import requesters if their actor IDs coincide in ImportDump

ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can ac...

PT-2024-31895 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RuoYi versions 4.7.9 and earlier Description: The issue allows escaping from comments within the code generation feature, enabling the injection of malicious code. This flaw can be exploited to inject malicious code into the system...

PT-2024-32854 · Json Lib +2 · Json-Lib +2

Name of the Vulnerable Software and Affected Versions: JSON-lib versions prior to 3.1.0 Description: The issue is related to the handling of an unbalanced comment string in the util/JSONTokener.java file. This flaw can be exploited due to the mishandling of such strings. Recommendations: For...

Aimeos frontend controller 安全漏洞

Aimeos frontend controller is an Aimeos open source frontend controller. Aimeos frontend controller has a security vulnerability that stems from an insecure direct object reference that could allow an attacker to disable the subscribe and comment functionality for other clients. The following...

CVE-2024-8481

The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.2. This is due to the plugin adding the filter addfilter'commenttext', 'doshortcode'; which will run all shortcodes in comments. This makes it possible for...

CVE-2024-8481

CVE-2024-8481 affects the WordPress plugin Special Text Boxes up to 6.2.2 due to the filter add_filter('comment_text','do_shortcode') allowing unauthenticated arbitrary shortcode execution in comments. A patch exists; upgrade to 6.2.4 or later to remediate.

CVE-2024-8481 Special Text Boxes <= 6.2.2 - Unauthenticated Arbitrary Shortcode Execution

The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.2. This is due to the plugin adding the filter addfilter'commenttext', 'doshortcode'; which will run all shortcodes in comments. This makes it possible for...

golang: net/mail: comments in display names are incorrectly handled

A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using...

PT-2024-39047 · WordPress · Special Text Boxes

Name of the Vulnerable Software and Affected Versions: The Special Text Boxes plugin for WordPress versions up to and including 6.2.2 Description: The issue is related to arbitrary shortcode execution. This is due to the plugin adding the filter add filter'comment text','do shortcode';, which run...

PT-2024-41084 · Iptables · Iptables

Name of the Vulnerable Software and Affected Versions: iptables affected versions not specified Description: The issue is related to insecure privilege management in the iptables utility for configuring and managing packet filtering rules in the Linux operating system. Exploitation of this issue...

PT-2024-39045 · WordPress · Simple Spoiler

Name of the Vulnerable Software and Affected Versions: The Simple Spoiler plugin for WordPress versions 1.2 to 1.3 Description: The issue is due to the plugin adding the filter add filter'comment text','do shortcode', which runs all shortcodes in comments. This allows unauthenticated attackers to...

PT-2024-39044 · WordPress · Affiliate Super Assistent

Name of the Vulnerable Software and Affected Versions: The Affiliate Super Assistent plugin for WordPress versions up to, and including, 1.5.3 Description: The issue is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This...

SUSE SLED15: libsystemd0 / libsystemd0-32bit / libudev1 / libudev1-32bit / etc (SUSE-SU-2024:3149-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3149-1 advisory. - CVE-2023-7008: Fixed man-in-the-middle due to unsigned name response in signed zone not refused when...

CVE-2024-8412 LinuxOSsk Shakal-NG views.py redirect

A vulnerability, which was classified as problematic, was found in LinuxOSsk Shakal-NG up to 1.3.3. Affected is an unknown function of the file comments/views.py. The manipulation of the argument next leads to open redirect. It is possible to launch the attack remotely. The name of the patch is...

PT-2024-38994 · Unknown · Linuxossk Shakal-Ng

Name of the Vulnerable Software and Affected Versions: LinuxOSsk Shakal-NG versions up to 1.3.3 Description: A problematic issue was found in LinuxOSsk Shakal-NG, affecting an unknown function of the file comments/views.py. The manipulation of the next argument leads to open redirect. It is...

WordPress Subscribe Comments File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Subscribe Comments File Read Vulnerability', 'Description' = %q This module exploits an authenticated directory traversal vulnerability...