WordPress WP Voting Contest plugin <= 2.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Brandon James Roldan in WordPress WP Voting Contest plugin versions = 2.1. Solution Update the WordPress WP Voting Contest plugin to the latest available version at least 3.0...

CVE-2022-27853

Authenticated author or higher role Stored Cross-Site Scripting XSS in Contest Gallery WordPress plugin = 13.1.0.9...

WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien in WordPress Contest Gallery plugin versions = 13.1.0.9. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 14.0.0...

WordPress Contest Gallery SQL Injection Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. WordPress Contest Gallery SQL injection vulnerability,...

CVE-2021-24915

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

CVE-2021-24915

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

CVE-2021-24915 Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

CVE-2021-24915

The Contest Gallery WordPress plugin (prior to 13.1.0.6) lacks capability checks and does not sanitise/escape cg-search-user-name-original before using it in a SQL statement when exporting gallery users, enabling unauthenticated SQL injection and disclosure of all usernames and email addresses. T...

WordPress SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. WordPress Contest Gallery SQL injection vulnerability,...

Malwarebytes CrackMe – contest summary

On October 29 we published our third CrackMe Challenge and announced two parallel tracks for the contest: "The fastest solve" , and "The best write-up". In the first category "The fastest solve" , we got three winners already the first weekend following publication. Big congratulations to: @nazyw...

Contest Gallery < 13.1.0.7 - Subscriber+ Email Address Disclosure

The plugin does not have any proper access controls when exporting users from a gallery, which could allow any authenticated users such as subscriber to list all users from the blog, disclosing their username and email address POST...

WordPress Contest Gallery plugin <= 13.1.0.5 - Missing Access Controls to Unauthenticated SQL injection (SQLi) / Email Address Disclosure vulnerability

Missing Access Controls to Unauthenticated SQL injection SQLi / Email Address Disclosure vulnerability discovered by Tyler Miller in WordPress Contest Gallery plugin versions = 13.1.0.5. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 13.1.0.6...

WordPress Contest Gallery plugin <= 13.1.0.6 - Email Address Disclosure vulnerability

Email Address Disclosure vulnerability discovered by WPScanTeam in WordPress Contest Gallery plugin versions = 13.1.0.6. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 13.1.0.7...

Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users...

The return of the Malwarebytes CrackMe

This blog post was authored by Hasherezade Update: Malwarebytes Crackme : we already have the winners in the category "the fastest solve", congratulations! 1st: @nazywam 2nd: Suvaditya Sur @x0r19x91 3rd:@evandrix But we are still waiting for your submissions! -- Malwarebytes Threat Intelligence...

Windows 10, Linux, iOS, Chrome and Many Others at Hacked Tianfu Cup 2021

Windows 10, iOS 15, Google Chrome, Apple Safari, Microsoft Exchange Server, and Ubuntu 20 were successfully broken into using original, never-before-seen exploits at the Tianfu Cup 2021, the fourth edition of the international cybersecurity contest held in the city of Chengdu, China. Targets this...

[The Lost Bots] Bonus Episode: Velociraptor Contributor Competition

!\The Lost Bots\ Bonus Episode: Velociraptor Contributor Competitionhttps://blog.rapid7.com/content/images/2021/08/-The-Lost-Bots--Episode-1--External-Threat-Intelligence.jpeg Welcome back for a special bonus edition of The Lost Bots, a vlog series where Rapid7 Detection and Response Practice...

Cybercriminals Hold $115,000-Prize Contest to Find New Cryptocurrency Hacks

A top Russian-language underground forum has been running a "contest" for the past month, calling on its community to submit "unorthodox" ways to conduct cryptocurrency attacks. The forum's administrator, in an announcement made on April 20, 2021, invited members to submit papers that assess the...

How Akamai Employees Showed Up for Akamai Earth Month

Photo from an Akamai employee who took her bike out to enjoy nature during Akamai Earth Month. Akamai employees across the globe showed up in full force for Akamai Earth Month 2021 -- our campaign to help employees take small actions at home and in their community to make a difference for the...

VMware Fixes Critical Flaw in ESXi Hypervisor

VMware has hurried out fixes for a critical flaw in its ESXi hypervisor, a few weeks after it was found during China’s Tianfu Cup hacking competition. The use-after-free vulnerability CVE-2020-4004 has a CVSS score of 9.3 out of 10, making it critical. It exists in the eXtensible Host Controller...