WordPress Responsive Menu plugin <= 4.0.3 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability found by WordFence in WordPress Responsive Menu plugin versions = 4.0.3. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.0.4...

Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload

"A subscriber could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/themes/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further...

Responsive Menu < 4.0.4 - CSRF to Settings Update

"Attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site." function submitRequest var xhr = new...

CVE-2020-18215

Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the 1 adid, 2 menuid, and 3 cashoutid parameters, which could let a remote malicious user execute arbitrary code...

PT-2021-10156

Name of the Vulnerable Software and Affected Versions: PHPSHE version 1.7 Description: The issue concerns SQL Injection vulnerabilities in the PHPSHE software. Specifically, the vulnerabilities are found in the phpshe/admin.php file and can be exploited via the ad id, menu id, and cashout id...

CVE-2020-11920

An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code...

CVE-2020-11920

An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code...

Pyrescom Termod4 time management access control error

A security vulnerability exists in Pyrescom Termod4 time management devices that stems from the inclusion of local files in the devices allowing an authenticated, remote attacker to traverse directories and read sensitive files via the Maintenance Log menu and manipulate file paths in URLs...

Friday Squid Blogging: Vegan Chili Squid

The restaurant chain Wagamama is selling a vegan version of its Chilli Squid side dish made from king oyster mushrooms. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

PT-2021-10847

Name of the Vulnerable Software and Affected Versions Pyrescom Termod4 versions prior to 10.04k Description The issue allows authenticated remote attackers to traverse directories and read sensitive files. This is achieved by manipulating the file-path in the URL via the Maintenance Logs menu...

CVE-2020-27256

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers with physical access to change insulin therapy settings...

USN-4700-1 pyxdg vulnerability

Alexandre D'Hondt discovered that PyXDG did not properly sanitize input. An attacker could exploit this with a crafted .menu file to execute arbitrary code...

MISP Cross-Site Script Vulnerabilities

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in MISP version 2.4.136, which originates from...

CWA for Windows does not dynamically update icons in start menu (published applications) | works fine if refresh apps in CWA is done

This articles describes how we can force an update on start menu applications coming from Citrix workspace app on the endpoint when there is a chance made, i.e.- application name changed from Citrix studio etc...

Security update for cobbler (moderate)

openSUSE Security Update: Security update for cobbler Announcement ID: openSUSE-SU-2021:0058-1 Rating: moderate References: 1020376 1029276 1048183 1074594 1075014 1081714 1081739 1090205 1097733 1101670 1104189 1104190 1104287 1105440 1105442 1113747 1128754 1128926 1130658 1134588 1149075 11518...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

Remote Code Execution Exploit in Apache Tomcat 9.0.27 Apache...

WonderCMS Cross-Site Scripting Vulnerability (CNVD-2020-75631)

WonderCMS is an open source, fast, small and simple flat file cms. A cross-site scripting vulnerability exists in the Menu component in WonderCMS 3.1.3. An attacker can exploit this vulnerability to steal cookies...

CVE-2020-29469

WonderCMS 3.1.3 is affected by cross-site scripting XSS in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the...

CVE-2020-29469

WonderCMS 3.1.3 is affected by cross-site scripting XSS in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the...

Cross site scripting

WonderCMS 3.1.3 is affected by cross-site scripting XSS in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the...