CVE-2021-24688 Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...

Wordpress Plugin Orange Form 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. cross-site request forgery vulnerability exists in Wordpress Orange Form Plugin 1.0.1 and prior versions,...

WordPress SQL注入漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. A SQL injection vulnerability exists in the Wordpress Orange Form Plugin 1.0 and earlier versions, which originates in the product admin/orange-form-email.php file in the processbulkaction functi...

Wazawaka Goes Waka Waka

In January, KrebsOnSecurity examined clues left behind by "Wazawaka," the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since "lost his mind" according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a...

New Samba Bug Allows Remote Attackers to Execute Arbitrary Code as Root

Samba has issued software updates to address multiple security vulnerabilities that, if successfully exploited, could allow remote attackers to execute arbitrary code with the highest privileges on affected installations. Chief among them is CVE-2021-44142, which impacts all versions of Samba...

WordPress Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

Unauthenticated Arbitrary Post Deletion discovered by Francesco Carlucci in WordPress Orange Form versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of December 29, 2021 and is not available for download. This closure is temporary, pending a full review...

Orange Form <= 1.0 - SQL Injection via CSRF

In the plugin, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers...

WordPress Orange Form plugin <= 1.0 - SQL Injection (SQLi) via Cross-Site Request Forgery (CSRF) vulnerability

SQL Injection SQLi via Cross-Site Request Forgery CSRF vulnerability discovered by Francesco Carlucci in WordPress Orange Form plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of December 29, 2021 and is not available for download. This closure is temporary,...

Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

The plugin does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure...

Orange Form <= 1.0 - SQL Injection via CSRF

In the plugin, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers...

400 Banks’ Customers Targeted with Anubis Trojan

Customers of Chase, Wells Fargo, Bank of America and Capital One, along with nearly 400 other financial institutions, are being targeted by a malicious app disguised to look like the official account management platform for French telecom company Orange S.A. Researchers say this is just the...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-22005 VMware vCenter Server arbitrary file upload...

500,000 Fortinet VPN credentials exposed: Turn off, patch, reset passwords

A threat actor has leaked a list of almost 500,000 Fortinet VPN credentials, stolen from 87,000 vulnerable FortiGate SSL-VPN devices. The breach list provides raw access to organizations in 74 countries, including the USA, India, Taiwan, Italy, France, and Israel, with almost 3,000 US entities...

Exploit for Server-Side Request Forgery in Microsoft

Proxyshell-Scanner nuclei scanner for Proxyshell RCE CVE-2021...

ProxyShell Exploit Chain

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: ccondon-r7 at August 12, 2021 9:19pm UTC reported: Check out the Rapid7 analysis for details on the exploit chain. Seems like a lot of the PoC implementations so far are using admin mailboxes, but I’d imagine folks...

rConfig <= 3.9.6 Shell Upload Exploit

This Metasploit module allows an attacker with a privileged rConfig account to start a reverse shell due to an arbitrary file upload vulnerability in /lib/crud/vendors.crud.php. This module requires Metasploit: https://metasploit.com/download Current source:...

Takeaways from the Colonial Pipeline Ransomware Attack

If you feel like you’ve read a lot about ransomware in recent months, it’s because these attacks have indeed intensified. In 2020, ransomware attacks surged by 150 percent, with the average payment size increasing by more than 170 percent. Some of the notable victims include United Health Service...

SQL injection vulnerability in website builder system ne***.aspx page of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company specializing in Internet branding and Internet marketing. Hangzhou Orange Promise Technology Co., Ltd. station building system ne.aspx page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

SQL injection vulnerability in the website builder system ca***_sh***.aspx page of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company specializing in Internet branding and Internet marketing. Hangzhou Orange Promise Technology Co., Ltd. building system cash.aspx page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL injection vulnerability in ab***.aspx page of website building system of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company focusing on Internet branding and online marketing, specializing in the following areas: branded website customization, WeChat application development, e-commerce platform development, mobile application development. Hangzhou Orange Promis...