WordPress Mapping multiple URLs redirect same page plugin <= 5.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Mapping multiple URLs redirect same page plugin versions = 5.8. Solution Deactivate and delete. This plugin has been closed as of February 14, 2022 and is not available for download. This closure is temporary,...

Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape the mmurspid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=mmursp-list=editid="...

WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin <= 1.6.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin versions = 1.6.7. Solution Update the WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin to the latest...

WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin <= 1.6.7 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin versions = 1.6.7. Solution Update the WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin to the latest available version at least...

GSD-2022-1000565 lockdep: Correct lock_classes index mapping

lockdep: Correct lockclasses index mapping This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by commit...

GSD-2022-1000405 lockdep: Correct lock_classes index mapping

lockdep: Correct lockclasses index mapping This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.102 by commit...

Mapping nftContractToTokenIdToBuyPrice is not deleted correctly

Lines of code Vulnerability details Impact Users that have bought an NFT previously through the NFTMarketBuyPrice functionality will not be able to make use of this functionality again as the nftContractToTokenIdToBuyPrice mapping is not correctly deleted anywhere in the NFTMarketBuyPrice contrac...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-1258)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-4021

A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS...

B2 Command Line Tool TOCTOU application key disclosure

Impact Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race condition. The command line tool saves API keys and bucket...

CVE-2020-25717

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation...

AZL-36993 CVE-2020-25717 affecting package samba for versions less than 4.18.3-1

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation...

DEBIAN-CVE-2020-25717

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation...

Russian state-sponsored cyber actors targeting U.S. critical infrastructure

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here In a joint cybersecurity advisory, the Federal Bureau of Investigation FBI, the National Security Agency NSA, the Cybersecurity and Infrastructure Security Agency CISA revealed that Russian state-sponsored threat actors target...

CVE-2020-25717

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation...

SUSE SLES11: xen / xen-doc-html / xen-kmp-default / xen-kmp-pae / xen-libs / etc (SUSE-SU-2022:14886-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14886-1 advisory. - CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. XSA-394 bsc1194581 - CVE-2022-23035: Fixed insufficient cleanu...

SUSE-SU-2022:0469-1 Security update for xen

This update for xen fixes the following issues: - CVE-2022-23033: Fixed guestphysmapremovepage not removing the p2m mappings. XSA-393 bsc1194576 - CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. XSA-394 bsc1194581 - CVE-2022-23035: Fixed insufficient cleanup of...

SUSE-SU-2022:0468-1 Security update for xen

This update for xen fixes the following issues: - CVE-2022-23033: Fixed guestphysmapremovepage not removing the p2m mappings. XSA-393 bsc1194576 - CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. XSA-394 bsc1194581 - CVE-2022-23035: Fixed insufficient cleanup of...

Wrong logic around areOperatorsImported

Lines of code Vulnerability details Impact The logic related to the areOperatorsImported method is incorrect and can cause an operator not to be updated because the owner thinks it is already updated, and a vulnerable or defective one can be used. Proof of Concept The operators mapping is made up...

All Tokens Can Be Stolen From Shelter Contract

Lines of code Vulnerability details Impact function withdrawIERC20 token, address to external override requireactivatedtoken != 0 && activatedtoken + GRACEPERIOD block.timestamp, "shelter not activated"; uint256 amount = savedTokenstoken client.shareOftoken, msg.sender / client.totalSharetoken;...