CVE-2022-0209 Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site Scripting

The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0209

CVE-2022-0209 affects the Mitsol Social Post Feed WordPress plugin, specifically versions prior to 1.11. The issue is due to insufficient escaping of certain settings when they are output in HTML attributes, enabling cross-site scripting by high-privilege users (e.g., admins) even if unfiltered_h...

CVE-2022-0209 Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site Scripting

The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13037 · WordPress · Mitsol Social Post Feed

Name of the Vulnerable Software and Affected Versions: Mitsol Social Post Feed WordPress plugin versions prior to 1.11 Description: The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is possible because some settings are not properly escaped befor...

WordPress plugin Mitsol Social Post Feed 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Mitsol Social Post Feed plugin <= 1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Big Tiger in WordPress Mitsol Social Post Feed plugin versions = 1.10. Solution Deactivate and delete. This plugin has been closed as of and is not available for download. Reason: Security Issue...

Cisco Firepower Threat Defense Software Security Intelligence DNS Feed Bypass (cisco-sa-ftd-sidns-bypass-3PzA5pO)

A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This vulnerability is due to incorrect feed update processing. An attacker could exploit this...

Fedora: Security Advisory for php-openpsa-universalfeedcreator (FEDORA-2022-59f0ad964c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-22972

creationtimestamp| type| source ---|---|--- 2022-05-19 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=806 2022-05-19 08:16:48+00:00| seen| https://t.me/ctinow/52262 2022-05-19 12:12:49+00:00| exploited| https://t.me/truesecator/2957 2022-05-19 18:51:26+00:00| seen|...

Plone denial of service via RSS Feed Request

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...

GHSA-79HJ-474H-V4XV Plone denial of service via RSS Feed Request

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...

Fidelis Network Deception 命令注入漏洞

Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A command injection vulnerability exists in...

CVE-2022-24392

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feedcommtest” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and...

GHSA-VJXX-54VW-Q59F Moodle SSRF Vulnerability

The editblog.php script allows a registered user to add external RSS feed resources. It was identified that this feature could be abused to be used as a SSRF attack vector by adding a malicious URL/TCP PORT in order to target internal network or an internet hosted server, bypassing firewall rules...

Moodle SSRF Vulnerability

The editblog.php script allows a registered user to add external RSS feed resources. It was identified that this feature could be abused to be used as a SSRF attack vector by adding a malicious URL/TCP PORT in order to target internal network or an internet hosted server, bypassing firewall rules...

Withdrawn Advisory: Pulp Improper Path Parsing

Withdrawn Advisory This advisory has been withdrawn because the package pulpcore deals with pulp 3 only. This advisory concerns pulp 2, which is not in a supported ecosystem. Original Description pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a...

Moodle vulnerable to Cross-Site Request Forgery

Cross-site request forgery CSRF vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block...

CVE-2022-30333

creationtimestamp| type| source ---|---|--- 2022-05-09 12:31:04+00:00| seen| https://t.me/cibsecurity/42166 2022-06-29 05:00:04+00:00| exploited| https://t.me/cKure/9862 2022-06-29 07:20:27+00:00| published-proof-of-concept| https://t.me/TopCyberTechNews/51 2022-06-30 10:57:20+00:00| seen|...

Use of deprecated Chainlink function latestAnswer

Lines of code Vulnerability details Impact Use of deprecated Chainlink function latestAnswer According to Chainlink's documentation, the latestAnswer function is deprecated. This function does not error if no answer has been reached but returns 0, causing an incorrect price feed to USDC Price...

Oracle data feed is insufficiently validated

Lines of code Vulnerability details description When using Chainlink Price feeds it is important to ensure the price feed data was updated recently. While getting started with chainlink requires just one line of code, it is best to add additional checks for in production environments. findings...