CVE-2021-24689

CVE-2021-24689 concerns the WordPress plugin Contact Forms - Drag & Drop Contact Form Builder (versions up to 1.0.5). The vulnerability is a path traversal flaw that allows high-privilege users to download arbitrary files from the web server, via the plugin’s file download feature. The core issue...

WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...

WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

WordPress Drop Shadow Boxes plugin <= 1.7.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drop Shadow Boxes plugin versions = 1.7.4. Solution Update the WordPress Drop Shadow Boxes plugin to the latest available version at least 1.7.5...

PT-2022-9448

Name of the Vulnerable Software and Affected Versions The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin versions 1.0.0 through 1.0.5 Description The issue allows high privilege users to download arbitrary files from the web server via a path traversal attack. Recommendations F...

WordPress Drop Shadow Boxes plugin <= 1.7.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drop Shadow Boxes plugin versions = 1.7.4. Solution Update the WordPress Drop Shadow Boxes plugin to the latest available version at least 1.7.5...

WordPress plugin 路径遍历漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in Wordpress Drag & Drop Contact Form Plugin 1.0.5 and earlier...

WordPress Customizer custom controls with Drag and Drop builder – Customizely plugin <= 1.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Customizer custom controls with Drag and Drop builder – Customizely plugin versions = 1.1.0. Solution Update the WordPress Customizer custom controls with Drag and Drop builder – Customizely plugin to the latest available...

CVE-2022-0360: Improper Neutralization of Input During Web Page Generation

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues...

CVE-2021-24689: Improper Limitation of a Pathname to a Restricted Directory

The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...

GSD-2022-1000642 net/mlx5e: Avoid implicit modify hdr for decap drop rule

net/mlx5e: Avoid implicit modify hdr for decap drop rule This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.6 by commit...

GSD-2022-1000552 drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit

dropmonitor: fix data-race in dropmonnetevent / tracenapipollhit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by commit...

GSD-2022-1000353 drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit

dropmonitor: fix data-race in dropmonnetevent / tracenapipollhit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.181 by commit...

PT-2022-28916

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.16 through v5.16.5 Description The issue is related to the net/mlx5e component, where an implicit modify hdr for decap drop rule could potentially be exploited. The actual impact and attack plausibility have not yet be...

microweber 安全漏洞

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A logic flaw vulnerability exists in Microweber, which stems from an error in the business...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2022:14896-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14896-1 advisory. - A Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an arbitrary...

CVE-2022-20623

A vulnerability in the rate limiter for Bidirectional Forwarding Detection BFD traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause BFD traffic to be dropped on an affected device. This vulnerability is due to a logic error ...

microweber has an unspecified vulnerability (CNVD-2022-13203)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a security vulnerability, and no details of the vulnerability are available at this time...

ROS-20220210-01

A vulnerability in Mozilla Thunderbird email client and Firefox browser is related to incorrect handling of extension updates. Exploitation of the vulnerability could allow an attacker acting remotely to trick the victim into install a particular type of browser extension and, during automatic...