EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-1027)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which in some situations allows...

WordPress affiliate Manager WordPress plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the WordPress plugin Affiliates Manager prior to...

CVE-2021-25078

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests...

Cross site scripting

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry...

Emotet Now Using Unconventional IP Address Formats to Evade Detection

Social engineering campaigns involving the deployment of the Emotet malware botnet have been observed using "unconventional" IP address formats for the first time in a bid to sidestep detection by security solutions. This involves the use of hexadecimal and octal representations of the IP address...

PhpIPAM Cross-Site Scripting Vulnerability (CNVD-2022-08175)

phpIPAM is an open source PHP and MySQL-based IP address management application IPAM. phpIPAM in v1.4.4 is vulnerable to a cross-site scripting vulnerability that stems from a lack of user-supplied data and output data validation filtering in the Site title parameter when updating site settings. ...

lib60870代码问题漏洞

lib60870 is a C language library based on the IEC60870-5 protocol. The library provides support for CompanionStandard 101 CS101 and 104 CS104 of the IEC family of standards for remote control applications IEC60870-5 and is commonly used in power systems for communication between central station...

Design/Logic Flaw

A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an attacker to download the configuration file used in the device and apply a modified configuration file back to the device. The attack requires network access to...

CVE-2021-44564

The CVE-2021-44564 issue affects Kalkitech Sync SYNC2101/Sync family devices where management communications between Easyconnect and the SYNC device are performed over an unsecured channel. Root cause: insecure communication channel used by the administration tool, enabling attackers with network...

CVE-2022-20021

creationtimestamp| type| source ---|---|--- 2022-01-04 18:39:28+00:00| seen| https://t.me/cibsecurity/34932...

Session fixation

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker whether from a different computer,...

CVE-2021-20151

Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker whether from a different computer,...

Trendnet AC2600 授权问题漏洞

The Trendnet AC2600 is a wireless router from Trendnet. The Trendnet AC2600 TEW-827DRU version 2.08B01 has an authorization issue vulnerability that stems from a flaw in the device's session management. The router's management software manages IP address-based web sessions instead of validating...

Iball WRD12EN 跨站请求伪造漏洞

The Iball WRD12EN is a router from iBall Iball India. The iBall WRD12EN version 1.0.0 suffers from a cross-site request forgery vulnerability that stems from a software request that lacks cross-site request forgery token validation, which can be exploited by an attacker to enable DNS settings or...

CVE-2021-4189

A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecti...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

CVE-2021-45471

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

CVE-2021-45471

CVE-2021-45471 affects MediaWiki up to version 1.37, where a flaw in EntitySchema editing allows blocked IPs to edit EntitySchema items. The vulnerability has a network attack vector with low complexity and no authentication, resulting in partial integrity impact without confidentiality or availa...

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests. PoC As unauthenticated: wget "https://example.com/?wpamid=1"...