584 matches found
Markdown-Nice 跨站脚本漏洞
Markdown-Nice is an open source Markdown editor that supports theme design by inkdrop software mdnice. A security vulnerability exists in Markdown-Nice v1.8.22 that stems from the presence of cross-site scripting XSS, which allows an attacker to execute arbitrary web script or HTML via a speciall...
PT-2022-24496 · Unknown · Markdown-Nice
Name of the Vulnerable Software and Affected Versions: Markdown-Nice version 1.8.22 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field. Recommendations: For Markdown-Nice version...
CVE-2022-38639: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field...
Friday Squid Blogging: Squid Images
iStock has over 13,000 royalty-free images of squid. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...
CVE-2022-35933
PrestaShop Product Comments module (for PrestaShop) is affected by a cross-site scripting vulnerability prior to 5.0.2 that can allow an attacker to steal an administrator’s cookie. The root cause is insufficient filtering/escaping of user-supplied data, enabling cookie theft via crafted input. R...
WordPress Robo Gallery 3.2.1 plugin - XSS Stored Vulnerability
Title: WordPress 6.0.1 Plugin-Robo Gallery 3.2.1 XSS-Stored Author: nu11secur1ty Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/robo-gallery/ Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/RoboGallery/XSS-Stored Description: Th...
APT Lazarus Targets Engineers with macOS Malware
North Korean APT Lazarus is up to its old tricks with a cyberespionage campaign targeting engineers with a fake job posting that attempt to spread macOS malware. The malicious Mac executable used in the campaign targets both Apple and Intel chip-based systems. The campaign, identified by...
Friday Squid Blogging: Squid Inks Fisherman
Short video. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
CVE-2014-3648
The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached...
Friday Squid Blogging: More on the “Mind Boggling” Squid Genome
Octopus and squid genes are weird. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
JupiterX Core 访问控制错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress JupiterX Core plugin is vulnerable to an access control error, which could be exploited by ...
CVE-2022-30011
In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability...
GHSA-P5J7-26WJ-423J Moodle allows discovery of an author's username
The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...
CVE-2011-1762
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publishposts' permission...
CVE-2011-1762
A flaw exists in Wordpress related to the ‘wp-admin/press-this.php ‘script improperly checking user permissions when publishing posts. This may allow a user with ‘Contributor-level’ privileges to post as if they had ‘publishposts’ permission. Recent assessments: Assessed Attacker Value: 0 Assesse...
Wordpress 安全漏洞
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers, and a permission checking error vulnerability exists in Wordpress, which stems from the wp-admin/press-this.php script that...
Friday Squid Blogging: Far Side Cartoon
Squid, of course. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
WordPress Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin <= 3.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin versions = 3.4.0. Solution Update the WordPress Guest posting / Frontend Posting wordpress plugin – WP Fro...
WordPress Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin <= 3.4.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin versions = 3.4.0. Solution Update the WordPress Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front...
Friday Squid Blogging: Climate Change Causing “Squid Bloom” along Pacific Coast
The oceans are warmer, which means more squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...