WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

Authenticated Arbitrary File Download vulnerability discovered by Ex.Mi Patchstack in WordPress Download Monitor plugin versions = 4.4.6. Solution Update the WordPress Download Monitor plugin to the latest available version at least 4.4.7...

SolarWinds Orion Network Performance Monitor DisableNOCView SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Orion Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the DisableNOCView method. The issue results from the lack of prop...

October 21, 2021—KB5006746 (OS Build 22000.282) Preview

None None...

Download Monitor < 4.4.5 - Admin+ SQL Injection

The plugin does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue PoC There need to be at least one log for the payload to trigger...

Download Monitor < 4.4.5 - Admin+ SQL Injection

The plugin does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue There need to be at least one log for the payload to trigger...

WordPress Download Monitor plugin <= 4.4.4 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by bl4derunner in WordPress Download Monitor plugin versions = 4.4.4. Solution Update the WordPress Download Monitor plugin to the latest available version at least 4.4.5...

Vulnerabilities fixed in Oracle MySQL

Oracle has fixed vulnerabilities in the following MySQL products: MySQL Workbench MySQL Server MySQL Cluster MySQL Enterprise Monitor MySQL Connectors The vulnerabilities potentially enable a malicious party to execute attacks that result in the following categories of damage: Denial-of-Service D...

Oracle MySQL Enterprise Monitor (Oct 2021 CPU)

The 8.0.25 versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory. - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL component: Monitoring: General Spring Security. Supported...

How to Configure an LDAP Monitor on Citrix ADC

This article describes how to configure an LDAP monitor on Citrix ADC...

a-texam (=1.1.0), aait (>=1.0.4 <=1.0.5) +1100 more potentially affected by CVE-2019-9423 via opencv-contrib-python (>=3.4.11.45 <=4.1.1.26)

opencv-contrib-python PYPI version =3.4.11.45, =1.0.4, =0.0.29, =1.11.4, =0.5.0, =0.1.0, =24.3.2, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0, =1.0.3 and more Source cves: CVE-2019-9423 Source advisory: OSV:GHSA-8849-5H85-98QW...

FUSE - A Penetration Testing Tool For Finding File Upload Bugs

FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload UEFU vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute FUSE,...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by an SNMPD vulnerability

Summary IBM Security Guardium Database Activity Monitor has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2002-0013 DESCRIPTION: Many vendor implementations of the Simple Network Management Protocol SNMP have multiple remote vulnerabilities caused by the improper handlin...

Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

The plugin does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could ma...

Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting

The plugin does not escape the 1 sdmactivetab GET parameter and 2 sdmstatsstartdate/sdmstatsenddate POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC 1: This requires Firefox due to onclick+accesskey trick on hidden input. There is...

WordPress Simple Download Monitor plugin <= 3.9.5 - Arbitrary Thumbnails Removal vulnerability

Arbitrary Thumbnails Removal vulnerability discovered by apple502j in WordPress Simple Download Monitor plugin versions = 3.9.5. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.6...

WordPress Simple Download Monitor plugin <= 3.9.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Simple Download Monitor plugin versions = 3.9.4. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.5...

WordPress Simple Download Monitor plugin <= 3.9.5 - Arbitrary Thumbnails Removal vulnerability

Arbitrary Thumbnails Removal vulnerability discovered by apple502j in WordPress Simple Download Monitor plugin versions = 3.9.5. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.6...

Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting

The plugin does not escape the 1 sdmactivetab GET parameter and 2 sdmstatsstartdate/sdmstatsenddate POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC PoC 1: This requires Firefox due to onclick+accesskey trick on hidden input. There is...

WordPress Simple Download Monitor plugin <= 3.9.5.1 - Unauthenticated Log Access vulnerability

Unauthenticated Log Access vulnerability discovered by apple502j in WordPress Simple Download Monitor plugin versions = 3.9.5.1. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.6...

WordPress Simple Download Monitor plugin <= 3.9.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Simple Download Monitor plugin versions = 3.9.4. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.5...