CVE-2021-24918 Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

PT-2021-16367

Name of the Vulnerable Software and Affected Versions: Smash Balloon Social Post Feed WordPress plugin versions prior to 4.0.1 Description: The issue allows any logged-in user on a vulnerable site to update the plugin's settings without proper privilege or nonce validation. This enables the stora...

WordPress 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress Plugin is a WordPress open source application plugin. WordPress Smash Balloon Social Post Feed...

CVE-2021-41379

creationtimestamp| type| source ---|---|--- 2021-11-22 08:37:42+00:00| published-proof-of-concept| https://t.me/poxek/140 2021-11-22 09:30:27+00:00| published-proof-of-concept| https://t.me/hackertrick/464 2021-11-22 23:37:12+00:00| published-proof-of-concept| https://t.me/ckuRED/66 2021-11-22...

Using Object Storage with Veeam Products

Summary Veeam Backup & Replication supports object storage as a destination for long-term data storage. Similarly, Veeam Backup for Office 365 and cloud-specific offerings, such as Veeam Backup for AWS, Veeam Backup for Azure, Veeam Backup for Google Cloud Platform all support object storage. Thi...

CVE-2021-42292

creationtimestamp| type| source ---|---|--- 2021-11-10 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=690 2021-11-10 07:32:55+00:00| seen| https://t.me/thehackernews/1642 2021-11-10 07:41:45+00:00| seen| https://t.me/cibsecurity/32133 2021-11-10 12:44:04+00:00| seen|...

Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

The plugin does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site...

Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

The plugin does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site...

python-pillow: Excessive CPU use in EPS image reader

A flaw was found in python-pillow. The readline used in EPS has to deal with any combination of \r and \n as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a denial-of-service of Pillow in...

Permissioned nature of TwapOracle allows owner to manipulate oracle

Handle TomFrench Vulnerability details Impact Potentially frozen or purposefully inaccurate USDV:VADER price feed. Proof of Concept Only the owner of TwapOracle can call update on the oracle. Should the owner desire they could cease calling update on the oracle for a period. Over this period the...

CVE-2021-42770

creationtimestamp| type| source ---|---|--- 2021-11-08 18:29:04+00:00| seen| https://t.me/cibsecurity/31983...

CVE-2020-0878

creationtimestamp| type| source ---|---|--- 2021-11-08 08:58:18+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:23:29+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971045 2025-02-23...

CVE-2020-9818

creationtimestamp| type| source ---|---|--- 2021-11-08 08:58:17+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-05 10:49:44+00:00| seen| https://t.me/arpsyndicate/1459 2024-12-24 20:24:52+00:00| seen|...

CVE-2021-24793

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793 WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793

CVE-2021-24793 references the WPeMatico RSS Feed Fetcher WordPress plugin, before version 2.6.12, which does not escape the feed URL added to a campaign before outputting it in an attribute. This enables stored Cross‑Site Scripting (XSS) when exploited by high‑privilege users, even when unfiltere...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin WPeMatico RSS Feed Fetcher prior...

CVE-2021-34484

creationtimestamp| type| source ---|---|--- 2021-10-29 18:59:00+00:00| exploited| https://t.me/truesecator/2270 2021-10-29 22:19:37+00:00| published-proof-of-concept| https://t.me/hackertrick/363 2021-10-30 14:34:03+00:00| exploited| https://t.me/NeKaspersky/1395 2021-11-10 23:12:02+00:00|...

CVE-2021-38000

creationtimestamp| type| source ---|---|--- 2021-10-29 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=682 2021-10-29 06:14:24+00:00| exploited| https://t.me/cKure/7810 2021-10-29 16:50:00+00:00| exploited| https://t.me/truesecator/2268 2021-10-30 15:46:49+00:00| seen|...