WordPress Plugin Simple History Security Bypass Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security bypass vulnerability exists in the WordPress plugin Simple History, which can be exploited by attackers to insert malicious data into l...

MariaDB 10.1.0 < 10.1.29 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.1.29. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.1.29 advisory. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Replication. Supported versions that are...

MariaDB 10.0.0 < 10.0.33 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.0.33. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.33 advisory. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Replication. Supported versions that are...

MariaDB 10.1.0 < 10.1.30 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.1.30 advisory. - sql/eventdataobjects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and...

Updated firefox packages fix security vulnerability

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations CVE-2022-43680. Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for...

We Need Smarter Smart Contracts To Prevent DeFi Hacks

By Waqas The smart contracts that govern DeFi are littered with exploitable code, and hackers understand that since hundreds of millions of crypto funds have been siphoned off due to this very issue. This is a post from HackRead.com Read the original post: We Need Smarter Smart Contracts To Preve...

Buddybadges <= 1.0.0 - Admin+ SQLi

The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users PoC https://example.com/wp-admin/options-general.php?page=buddybadge&wpedit=b2f9b59706=1+AND+SELECT+7741+FROM+SELECTSLEEP10hlAf...

Red Lion Crimson

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Red Lion Controls Equipment: Crimson Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain user credential hashes. 3...

GHSA-H8HF-HXX6-5G6V Cross-site Scripting in Jenkins Naginator Plugin

Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to edit build display names. Naginator Plugin 1.18.2 escapes display nam...

CVE-2022-45406

The Mozilla Foundation Security Advisory describes this flaw as: If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash...

CVE-2022-45405

The Mozilla Foundation Security Advisory describes this flaw as: Freeing arbitrary nsIInputStream's on a different thread than creation could have led to a use-after-free and potentially exploitable crash...

CVE-2022-45409

The garbage collector could have been aborted in several states and zones and GCRuntime::finishCollection may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

CVE-2022-45405

Freeing arbitrary nsIInputStream's on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

CVE-2022-45406

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5,...

CVE-2022-21608

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2022-21604

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of thi...

CVE-2022-39410

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

Line of credit status can be set to REPAID even if having credits with debt

Lines of code Vulnerability details A malicious borrower can close non-existing credits to alter the status of the credit to LineLib.STATUS.REPAID, even if having open credit with debt. Impact The close function in the LineOfCredit contract can be used to close non-existing credits, which will...

Delta Electronics DIAEnergie

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: DIAEnergie --------- Begin Update B part 1 of 5 --------- Vulnerabilities: Cross-site Scripting, SQL Injection, Authorization Bypass --------- End Update B part 1 of 5...

MariaDB 10.3.0 < 10.3.11 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.3.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.3.11 advisory. - The crc32big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors...