CVE-2021-24348 Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection

The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue...

CVE-2021-24348

The CVE-2021-24348 affects the WordPress Side Menu plugin (versions before 3.1.5). The vulnerability arises in the menu delete functionality where an administrator-accessible did GET parameter is interpolated into an SQL statement without proper sanitisation, validation, or escaping, enabling SQL...

CVE-2021-24348: Improper Neutralization of Special Elements used in an SQL Command

The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue...

PT-2021-15884

Name of the Vulnerable Software and Affected Versions Side Menu – add fixed side buttons WordPress plugin versions prior to 3.1.5 Description The issue concerns the menu delete functionality, which is accessible to Administrator users. It takes the did GET parameter and uses it in an SQL statemen...

SUSE SLES11 Security Update : grub2 (SUSE-SU-2021:14659-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14659-1 advisory. - The grubext2readblock function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote...

WordPress Side Menu plugin <= 3.1.3 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Side Menu plugin versions = 3.1.3. Solution Update the WordPress Side Menu plugin to the latest available version at least 3.1.5...

Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection

The menu delete functionality of the plugin, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue GET...

Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection

The menu delete functionality of the plugin, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue PoC GET /wp-admin/admin.php?page=side-menu=del=1%20OR%201=1...

Backdoor.Win32.DarkMoon.a Weak Hardcoded Password

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/7361fe3620fb6e18467c8e15e224b0b8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.DarkMoon.a Vulnerability: Weak Hardcoded Password Description: Dark Moon v1 client by...

EulerOS 2.0 SP5 : grub2 (EulerOS-SA-2021-1900)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and...

com.cooldatasoft:wicket-menu (>=6.10.0, <=6.10.0.4), com.cooldatasoft:wicket-menu-demo (>=6.10.0, <=6.10.0.4) +221 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (6.10.0)

org.apache.wicket:wicket-core MAVEN version 6.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.cooldatasoft:wicket-menu =6.10.0, =6.10.0, =0.2, =0.0.2, =0.1.0, =0.1.0, =3.5, =3.5, =3.9 -...

at.molindo:molindo-wicket-utils (3.0.0), com.cooldatasoft:wicket-menu (>=6.14.0.0, <=6.14.0.4) +233 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (6.14.0)

org.apache.wicket:wicket-core MAVEN version 6.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - at.molindo:molindo-wicket-utils 3.0.0 - com.cooldatasoft:wicket-menu =6.14.0.0, =6.14.0.0, =6.14.0,...

com.cantaa:cantaa-commons (1.1), com.cooldatasoft:wicket-menu (>=6.16.0.0, <=6.16.0.4) +243 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (6.16.0)

org.apache.wicket:wicket-core MAVEN version 6.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.cantaa:cantaa-commons 1.1 - com.cooldatasoft:wicket-menu =6.16.0.0, =6.16.0.0, =1.0.0, =0.9.4,...

com.cooldatasoft:wicket-menu (>=6.18.0.0, <=6.18.0.4), com.cooldatasoft:wicket-menu-demo (>=6.18.0.0, <=6.18.0.4) +310 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (6.18.0)

org.apache.wicket:wicket-core MAVEN version 6.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.cooldatasoft:wicket-menu =6.18.0.0, =6.18.0.0, =6.18.0, =6.18.0, =6.18.0, =6.18.0, =6.18.0,...

Anote 1.0 - XSS to Remote Command Execution Vulnerability

Exploit Title: Anote 1.0 - XSS to RCE Exploit Author: TaurusOmar CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Risk: High 8.8 Vendor Homepage: https://github.com/AnotherNote/anote Version: 1.0 Tested on: Linux, MacOs Software Description: A simple opensource note app support markdown only, anote...

WordPress Food And Drink Menu Plugin Remote Code Execution (CVE-2020-29045)

A remote code execution vulnerability exists in WordPress Food And Drink Menu Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

EulerOS 2.0 SP3 : grub2 (EulerOS-SA-2021-1794)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This...

KB5001412: Setup Dynamic Update for Windows 10, version 2004 and 20H2: April 27, 2021

None None...

Apple AirDrop Bug Could Leak Your Personal Info to Anyone Nearby

New research has uncovered privacy weaknesses in Apple's wireless file-sharing protocol that could result in the exposure of a user's contact information such as email addresses and phone numbers. "As an attacker, it is possible to learn the phone numbers and email addresses of AirDrop users – ev...

SUSE: Security Advisory (SUSE-SU-2017:1445-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...