CVE-2022-23094

A vulnerability was found in libreswan. A malformed packet that is being rejected triggers a logging action that causes a NULL pointer dereference issue, leading to a crash of the pluto daemon. Mitigation If all configured connections are using IKEv2, the IKEv1 subsystem can be disabled by adding...

PT-2022-12582 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1 Description: An issue allows some unprivileged users to view confidential information, such as IP addresses and User-Agent...

Server-side Request Forgery (SSRF)

uppy is vulnerable to server-side request forgery. The vulnerability exists in the isPrivateIP function in request.js as it does not properly check IPv4-mapped IPv6 addresses when it contains a double colon in front of the IP address example: ::ffff:7f00:2, allowing an attacker to send requests o...

CVE-2020-29292

iBall WRD12EN 1.0.0 devices allow cross-site request forgery CSRF attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses...

Cross site request forgery (csrf)

iBall WRD12EN 1.0.0 devices allow cross-site request forgery CSRF attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses...

CVE-2020-29292

iBall WRD12EN 1.0.0 devices allow cross-site request forgery CSRF attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses...

CVE-2020-29292

The CVE-2020-29292 entry covers the iBall WRD12EN router (version 1.0.0) with a confirmed Cross-Site Request Forgery (CSRF) vulnerability. Public sources in the connected set describe that CSRF allows an attacker to alter DNS settings or modify IP address ranges on the device. The CNNVD entry exp...

CVE-2021-45471

A flaw was found in mediawiki in versions through 1.37. Blocked IP addresses are allowed to edit EntitySchema items...

Design/Logic Flaw

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items...

Aver EVC300 Firmware 00.10.16.36 Hardcoded Secrets Vulnerability

Aver EVC300 firmware version 00.10.16.36 suffers from having multiple hard-coded secrets that can allow for access bypass. Firmware for Aver EVC300 multipoint video conferencing system v00.10.16.36 and others as well as firmware for several other devices manufactured by Aver, potentially all...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228: Log4j / Log4Shell Security Research Summary...

CVE-2021-24945

The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog...

CVE-2021-24945

The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog...

Cross site request forgery (csrf)

The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog...

SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2021:3848-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3848-1 advisory. The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs wer...

Cisco IOS XE Software IKEv2 AutoReconnect Feature DoS (cisco-sa-ikev2-ebFrwMPr)

According to its self-reported version, Cisco IOS-XE Software is affected by a denial of service DoS vulnerability in its AutoReconnect feature. An authenticated, remote attacker can exploit this issue to cause a DoS condition by exhausting the free IP addresses from the assigned local pool. Plea...

AWS Attacks Targeting WordPress Increase 5X

The Wordfence Threat Intelligence team has been tracking a huge increase in malicious login attempts against WordPress sites in our network. Since November 17, 2021, the number of attacks targeting login pages has doubled. We’ve seen a global increase in attacks against WordPress sites during the...

Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure

The plugin does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog. PoC fetch"http://example.com/wp-admin/admin-ajax.php",...

Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure

The plugin does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog. fetch"http://example.com/wp-admin/admin-ajax.php",...

WordPress Like Button Rating plugin <= 2.6.37 - Unauthorized Vote Export to Email & IP Addresses Disclosure vulnerability

Unauthorized Vote Export to Email & IP Addresses Disclosure vulnerability discovered by Krzysztof Zając in WordPress Like Button Rating plugin versions = 2.6.37. Solution Update the WordPress Like Button Rating plugin to the latest available version at least 2.6.38...