CVE-2021-24209

The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated admin+ RCE in the settings page due to input validation failure and weak $cachepath check in the WP Super Cache Settings - Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so...

CVE-2021-24209

CVE-2021-24209 affects the WP Super Cache WordPress plugin prior to 1.7.2. It enables an authenticated (admin+) RCE via the Settings → Cache Location option due to input validation failure and a weak $cache_path check, with direct access to wp-cache-config.php permitting web shell injection. Rela...

CVE-2021-24209 WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)

The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated admin+ RCE in the settings page due to input validation failure and weak $cachepath check in the WP Super Cache Settings - Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so...

PT-2021-15754 · WordPress · Wp Super Cache

Name of the Vulnerable Software and Affected Versions: WP Super Cache versions prior to 1.7.2 Description: The issue is related to an authenticated remote code execution RCE in the settings page of the WP Super Cache WordPress plugin. This is due to a failure in input validation and a weak check ...

533 Million Facebook Users' Phone Numbers and Personal Data Leaked Online

In what's likely to be a goldmine for bad actors, personal information associated with approximately 533 million Facebook users worldwide has been leaked on a popular cybercrime forum for free—which was harvested by hackers in 2019 using a Facebook vulnerability. The leaked data includes full...

CVE-2020-11922

An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being...

Hackers Set Up a Fake Cybersecurity Firm to Target Security Experts

A North Korean government-backed campaign targeting cybersecurity researchers with malware has re-emerged with new tactics in their arsenal as part of a fresh social engineering attack. In an update shared on Wednesday, Google's Threat Analysis Group said the attackers behind the operation set up...

Esri ArcGIS Server Buffer Overflow Vulnerability

Esri Arcgis Server is the United States Esri company's a Web-oriented can be used to provide geographic location services, enterprise-class software platform. A buffer overflow vulnerability exists in Esri ArcGIS Server 10.8.1 and earlier, which can be exploited by an attacker to achieve arbitrar...

Groups Call for Ethical Guidelines on Location-Tracking Tech

The Locus Charter asks companies to commit to 10 principles, including minimizing data collection and actively seeking consent from users...

Security update for tor (moderate)

openSUSE Security Update: Security update for tor Announcement ID: openSUSE-SU-2021:0474-1 Rating: moderate References: 1183726 Cross-References: CVE-2021-28089 CVE-2021-28090 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes two vulnerabilities is now available. Description:...

Design/Logic Flaw

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default...

GHSA-2R6J-862C-M2V2 Unrestricted File Upload in Form Framework

Problem Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default fileDenyPattern successfully blocked files like .htaccess or malicious.php. TYPO3 Extbase extensions, which implement ...

Unrestricted File Upload in Form Framework

Problem Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default fileDenyPattern successfully blocked files like .htaccess or malicious.php. TYPO3 Extbase extensions, which implement ...

OPENSUSE-SU-2021:0461-1 Security update for tor

This update for tor fixes the following issues: tor was updated to 0.4.5.7 https://lists.torproject.org/pipermail/tor-announce/2021-March/000216.html Fix 2 denial of service security issues boo1183726 + Disable the dumpdesc function that we used to dump unparseable information to disk...

Wordpress WP Google Map SQL Injection Vulnerability

Wordpress WP Google Map is an application plugin for Wordpress. Provides a way to quickly and easily add customized Google maps or store locators to WordPress posts and, or pages. A security vulnerability exists in WordPress plugin WP Google Map Plugin versions prior to 4.1.5, which originates in...

CVE-2021-24136

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

Cross site scripting

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24136

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24136 Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

Wordpress WP Google Map SQL注入漏洞

Wordpress WP Google Map is an application plugin for Wordpress. Provides a way to quickly and easily add customized Google maps or store locators to WordPress posts and, or pages. A security vulnerability exists in WordPress plugin WP Google Map Plugin versions prior to 4.1.5, which originates in...