CVE-2018-5653

The CVE-2018-5653 entry refers to a vulnerability in the WordPress plugin weblizar-pinterest-feeds version 1.1.1. The issue is an XSS vulnerability exploitable via the wp-admin/admin-ajax.php parameter weblizar_pffree_settings_save_get-users. Several connected sources (CNVD-2018-01274 and WPVulnD...

CVE-2018-5654

CVE-2018-5654 concerns the WordPress plugin weblizar-pinterest-feeds (version 1.1.1). The issue is a cross-site scripting (XSS) vulnerability exploitable through the wp-admin/admin-ajax.php endpoint via the PFFREE_Access_Token parameter. All connected sources identify an XSS in this plugin, with ...

CVE-2018-5655

The CVE-2018-5655 entry concerns the WordPress plugin weblizar-pinterest-feeds (v1.1.1). The vulnerability is an XSS in the wp-admin/admin-ajax.php security parameter. Affected component is the plugin’s handling of the admin-ajax requests; the exact root cause is not elaborated beyond “XSS exists...

CVE-2018-5656

CVE-2018-5656 concerns the WordPress plugin weblizar-pinterest-feeds (version 1.1.1). The connected documents specify a Cross-Site Request Forgery (CSRF) vulnerability via wp-admin/admin-ajax.php, affecting this plugin. The CVE entry identifies the issue and its risk metrics (NVD lists CVSS v3 ba...

CVE-2018-5654

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREEAccessToken parameter...

Pinterest Feed <= 1.1.1 - Authenticated XSS & CSRF

The Weblizar Pin Feeds WordPress plugin was affected by an Authenticated XSS & CSRF security vulnerability...

RIG exploit kit campaign gets deep into crypto craze

There isn't a day that goes by without a headline about yet another massive spike in Bitcoin valuation, or a story about someone mortgaging their house to purchase the hardware required to become a serious cryptocurrency miner. If many folks are thinking about joining the 'crypto craze' movement,...

CVE-2013-2597

creationtimestamp| type| source ---|---|--- 2017-12-03 11:10:28+00:00| seen| MISP/5a23a972-e6a0-4a05-b505-4e8f02de0b81 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 23:16:09+00:00| seen| https://t.me/arpsyndicate/1054 2024-12-24 20:33:09+00:00| seen|...

CVE-2013-2596

creationtimestamp| type| source ---|---|--- 2017-12-03 11:10:28+00:00| seen| MISP/5a23a972-e6a0-4a05-b505-4e8f02de0b81 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:33:08+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971713 2025-02-23...

UBUNTU-CVE-2017-17094

wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL...

CVE-2017-15639

tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature...

Design/Logic Flaw

tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature...

CVE-2017-15639

tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature...

CVE-2017-15639

tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature...

CVE-2017-15639

CVE-2017-15639 affects Mura CMS before 6.2. The readRSS.cfm file can be abused to bypass access restrictions via the draggable feeds feature. Exploitation details are documented (e.g., SSRF/XXE vectors) and public exploit references exist. The remedy is to upgrade to Mura CMS 6.2 or later or appl...

New National Vulnerability Database visualizations and feeds

Recently, the National Institute of Standards and Technology NIST introduced a new version of National Vulnerability Database NVD website.  I will not say that I liked this redesign: IMHO, old website with US flag was much prettier and useful: But the very fact that the site is developing, I...

Boston Red Sox Caught Using Technology to Steal Signs

The Boston Red Sox admitted to eavesdropping on the communications channel between catcher and pitcher. Stealing signs is believed to be particularly effective when there is a runner on second base who can both watch what hand signals the catcher is using to communicate with the pitcher and can...

CVE-2017-8570

creationtimestamp| type| source ---|---|--- 2017-09-02 13:40:38+00:00| seen| https://t.me/informationsecuritychannel/8407 2018-02-27 14:00:30+00:00| seen| MISP/5a955d28-c2e8-4016-beaa-41ed950d210f 2018-03-20 06:51:20+00:00| seen| MISP/5aafa3d9-cf3c-49fe-9c4e-2e52ac100a5a 2018-03-22 14:09:47+00:00...

Session Hijacking Bug Exposed GitLab Users Private Tokens

GitLab, the popular web-based Git repository manager, fixed a vulnerability recently that could have exposed its users to session hijacking attacks. Daniel Svartman, a security researcher with Imperva, discovered the issue in May but couldn’t disclose it until Wednesday, after GitLab was able to...

Rockstar Games: Stored XSS on member post feed

In this report, the researcher found a Stored XSS vulnerability in Profile Feeds. A POC was provided demonstrating the ability to affect any accessible member's Feed. We improved our filtering to automatically remove the harmful input, specifically including the bypass technique the researcher...