WordPress plugin Product Slider for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2022-16283 · WordPress · Product Slider For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Slider for WooCommerce WordPress plugin versions prior to 2.5.7 Description: The issue concerns flawed CSRF checks and a lack of authorization in some AJAX actions of the plugin, allowing any authenticated users to call them. This cou...

Clickjacking Leads To User Deletion

Hello team, on notrinoserp there is no clickjacking protection implemented x-frame-options, so an attacker can perform clickjacking attack, and in this case im able to delete user account via this vulnerability from the admin account, here is the POC: Exploit Script: iframe position:relative;...

clickjacking attack

Description clickjacking bug.\ I see there is no x-frame-options header set . So, the erp url can be loaded in iframe tag . which allow clickjacking attack Proof of Concept same this bellow code in html file and open this html url is browser . STUDY METERIAL...

Rocky Linux-system-roles bug fix and enhancement update

An update is available for rhel-system-roles. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Rocky Linux-system-roles package includes a collection of Ansib...

CVE-2022-1323

The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discyupdateoptions action, allowing any logged in users with privileges as low as Subscriber, to change Theme options by sending a crafted POST request...

CVE-2022-1323

The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discyupdateoptions action, allowing any logged in users with privileges as low as Subscriber, to change Theme options by sending a crafted POST request...

WordPress theme Discy 访问控制错误漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL.WordPress theme is a theme for WordPress. An Access Control Error vulnerability exists in WordPress theme Discy prior to version 5.0, which ste...

PT-2022-13797 · WordPress · Discy

Name of the Vulnerable Software and Affected Versions: Discy WordPress theme versions prior to 5.0 Description: The issue allows any logged-in users, with privileges as low as Subscriber, to change theme options by sending a crafted POST request to the "discy update options" action due to a lack ...

WordPress Plugin Discy 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2022-35926 Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The problem exists in the module...

WordPress Ecwid Ecommerce Shopping Cart plugin <= 6.10.23 - Cross-Site Request Forgery (CSRF) vulnerability leading to Settings/Options update

Cross-Site Request Forgery CSRF vulnerability leading to Settings/Options update discovered by Marco Wotschka in WordPress Ecwid Ecommerce Shopping Cart plugin versions = 6.10.23. Solution Update the WordPress Ecwid Shopping Cart plugin to the latest available version at least 6.10.24...

Code injection

AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checke...

CVE-2022-35928 AES Crypt for Linux Password Security Vulnerability

AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checke...

SUSE-SU-2022:2637-1 Security update for mokutil

This update for mokutil fixes the following issues: - Adds SBAT revocation support to mokutil. bsc1198458 New options added see manpage: - mokutil --sbat List all entries in SBAT. - mokutil --set-sbat-policy latest | previous | delete To set the SBAT acceptance policy. - mokutil...

SUSE-SU-2022:2636-1 Security update for mokutil

This update for mokutil fixes the following issues: - Adds SBAT revocation support to mokutil. bsc1198458 New options added see manpage: - mokutil --sbat List all entries in SBAT. - mokutil --set-sbat-policy latest | previous | delete To set the SBAT acceptance policy. - mokutil...

SUSE-SU-2022:2635-1 Security update for mokutil

This update for mokutil fixes the following issues: - Adds SBAT revocation support to mokutil. bsc1198458 New options added see manpage: - mokutil --sbat List all entries in SBAT. - mokutil --set-sbat-policy latest | previous | delete To set the SBAT acceptance policy. - mokutil...

SUSE-SU-2022:2633-1 Security update for mokutil

This update for mokutil fixes the following issues: - Adds SBAT revocation support to mokutil. bsc1198458 New options added see manpage: - mokutil --set-sbat-policy latest | previous | delete to set the SBAT acceptance policy. - mokutil --list-sbat-revocations To list the current SBAT revocations...

PT-2022-37509 · Mokutil · Mokutil

Name of the Vulnerable Software and Affected Versions: mokutil affected versions not specified Description: The issue concerns the addition of SBAT revocation support to mokutil. New options have been added to the mokutil command, including mokutil --sbat to list all entries in SBAT, mokutil...

PT-2022-37511 · Mokutil · Mokutil

Name of the Vulnerable Software and Affected Versions: mokutil affected versions not specified Description: The issue concerns the addition of SBAT revocation support to mokutil. New options have been added to the manpage, including mokutil --sbat to list all entries in SBAT, mokutil...