PT-2022-12991

Name of the Vulnerable Software and Affected Versions Visual Form Builder WordPress plugin versions prior to 3.0.8 Description The issue allows attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks due to the lack of nonce checks. Recommendations...

WordPress plugin Visual Form Builder has a cross-site request forgeing vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress Visual Form Builder plugin versions prio...

WordPress plugin Visual Form Builder has a access control error vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Visual Form Builder plugin versions prior...

PT-2022-12990 · WordPress · Visual Form Builder

Name of the Vulnerable Software and Affected Versions: Visual Form Builder WordPress plugin versions prior to 3.0.6 Description: The issue allows unauthenticated users to see form entries or export them as a CSV file due to a lack of access control on entry form export. This can be done using the...

Code injection

The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and fake entries...

Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF

The plugin does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks PoC Single entry trash: https://example.com/wp-admin/admin.php?page=vfb-entries=trash=2 Since entry permanent deletion:...

Vmware Photon injection vulnerability

Vmware Photon is a container-optimized cloud platform from US-based Vmware. A security vulnerability exists in SchedulerServer in Vmware photon that allows a remote attacker to inject logs via the package parameter in the inject logs. An attacker could also insert malicious data and fake entries...

WordPress Visual Form Builder plugin <= 3.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Entries Deletion/Restoration

Cross-Site Request Forgery CSRF vulnerability leading to Entries Deletion/Restoration discovered by Vishnupriya Ilango in WordPress Visual Form Builder plugin versions = 3.0.7. Solution Update the WordPress Visual Form Builder plugin to the latest available version at least 3.0.8...

Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF

The plugin does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks Single entry trash: https://example.com/wp-admin/admin.php?page=vfb-entries&action=trash&entry=2 Since entry permanent deletion:...

springframework: malicious input leads to insertion of additional log entries

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...

springframework: malicious input leads to insertion of additional log entries

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...

WordPress RSVP and Event Management plugin <= 2.7.7 - Unauthenticated Entries Export vulnerability

Unauthenticated Entries Export vulnerability discovered by Daniel Ruf in WordPress RSVP and Event Management plugin versions = 2.7.7. Solution Update the WordPress RSVP and Event Management plugin to the latest available version at least 2.7.8...

PT-2022-36894

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to a segmentation fault on an unknown address. The crash state includes functions such as sc file clear acl entries, sc file free, and...

CVE-2022-23121

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parseentries function. The issue results from the lack of proper error handling when parsin...

PT-2022-15865 · Netatalk +4 · Netatalk +4

Name of the Vulnerable Software and Affected Versions: Netatalk affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this issue. The specific flaw exists within th...

Unspecified Vulnerability in Gradle Enterprise

Gradle is the U.S. Gradle company's set of JVM-based project build tool , it supports maven, Ivy repository and so on. Gradle Enterprise prior to 2021.4.2 suffers from a security vulnerability that stems from the default built-in build cache configuration allowing anonymous write access. If this...

CVE-2022-0163

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednaosmartformsentrieslist AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form...

PT-2022-13004

Name of the Vulnerable Software and Affected Versions Smart Forms WordPress plugin versions prior to 2.6.71 Description The issue allows any authenticated user to download arbitrary form data due to a lack of authorization in the rednao smart forms entries list AJAX action. This could potentially...

CVE-2021-38267

Cross-site scripting XSS vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the comliferayblogswebportletBlogsAdminPortlettitle and...

log4j: Unsafe deserialization flaw in Chainsaw log viewer

A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...