186 matches found
CVE-2022-0784
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpextitles AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...
PT-2022-13437
Name of the Vulnerable Software and Affected Versions The Title Experiments Free WordPress plugin versions prior to 9.0.1 Description The issue concerns an unauthenticated SQL injection. It occurs because the id parameter is not properly sanitised and escaped before being used in a SQL statement...
WordPress plugin Title Experiments Free SQL注入漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Title Experiments Free plugin version 9.0.1 prior to the SQL injection vulnerability, the vulnerability stems from the use o...
CVE-2022-0784: Improper Neutralization of Special Elements used in an SQL Command
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpextitles AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...
WordPress Title Experiments Free plugin <= 9.0 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Title Experiments Free plugin versions = 9.0. Solution Update the WordPress Title Experiments Free plugin to the latest available version at least 9.0.1...
Title Experiments Free < 9.0.1 - Unauthenticated SQLi
The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the wpextitles AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection PoC curl 'https://example.com/wp-admin/admin-ajax.php' --data 'action=wpextitles=1 AND SELECT...
CVE-2021-42044
An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline,...
@digiwano/enquirer-experiments (>=0.0.1, <=0.0.3), firepit (0.0.1) +1 more potentially affected by CVE-2020-7716 via deeps (1.4.5)
deeps NPM version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on deeps and may be impacted: - @digiwano/enquirer-experiments =0.0.1, =0.0.3 - firepit 0.0.1 - rnfb-cli 1.0.0 Source cves: CVE-2020-7716 Source advisory: OSV:GHSA-RGFV-V3JH-7FFP...
Applied ThreadFix: Fire Bullets, Then Cannonballs – AppSec Edition
The concept of "firing bullets and then cannonballs" comes from the book Great By Choice by Jim Collins and Morten T. Hansen. The idea works a little like this: first fire your "bullets" - low-cost, low-risk, low-distraction experiments to figure out what will work. This allows you to calibrate...
If You Don’t Have 2, You Don’t Have 1
If You Don’t Have 2, You Don’t Have 1 “If you don’t have 2, you don’t have 1” is something you hear often in our engineering group. This is our team’s way of stressing the importance of persistence in data engineering. If a stream goes down, you lose it. You have to get confirmation that data is...
Research on Human Honesty
New research from Science: "Civic honesty around the globe": Abstract: Civic honesty is essential to social capital and economic development, but is often in conflict with material self-interest. We examine the trade-off between honesty and self-interest using field experiments in 355 cities...
US to Russia on Nuke Experiments: Do as We Say, Not as We Do
The US is quietly ramping up its plutonium experiments even as Washington raises concerns about Russian testing...
CVE-2018-12369
WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser permissions. This vulnerability affects Firefox ESR 60.1 and Firefox 61...
CVE-2018-12369
Summary (CVE-2018-12369) WebExtensions bundled with embedded experiments could bypass authorization checks, allowing a malicious WebExtension to gain full browser permissions. Affected products: Mozilla Firefox (non-ESR) versions before 61 and Firefox ESR before 60.1. Root cause: improper authori...
Exploit for CVE-2020-6616
Broadcom c...
3dpwn
VirtualBox 3D PoCs & exploits Author: @niklasbhttps://t...
UBUNTU-CVE-2018-12369
WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser permissions. This vulnerability affects Firefox ESR 60.1 and Firefox 61...
Experiments with Browser Preconnects
...
Friday Squid Blogging: How the Optic Lobe Controls Squid Camouflage
Experiments on the oval squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
Chinese Quantum Satellite Sends First ‘Unhackable’ Data to Earth
In what appears to be the world's first quantum satellite transmission, China has successfully sent an "unbreakable" code over a long distance from an orbiting satellite to the Earth, achieving a milestone in the next generation encryption based on "quantum cryptography." In August last year, Chi...