WordPress Security Audit 1.0.0 Cross Site Scripting

Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting XSS Date: 2022-01-26 Exploit Author: Shweta Mahajan Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/ Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/ Test...

WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)

Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting XSS Date: 2022-01-26 Exploit Author: Shweta Mahajan Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/ Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/ Test...

WordPress Security Audit plugin <= 1.0.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Shweta Mahajan in WordPress Security Audit plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of November 15, 2021 and is not available for download. Reason: Security Issue...

Dep-Scan - Fully Open-Source Security Audit For Project Dependencies Based On Known Vulnerabilities And Advisories. Supports Both Local Repos And Container Images. Integrates With Various CI Environments Such As Azure Pipelines, CircleCI, Google CloudBuild

dep-scan is a fully open-source security audit tool for project dependencies based on known vulnerabilities, advisories and license limitations. Both local repositories and container images are supported as input. The tool is ideal for CI environments with built-in build breaker logic. If you hav...

SEGA’s Sloppy Security Confession: Exposed AWS S3 Bucket Offers Up Steam API Access & More

Gaming giant SEGA Europe recently discovered that its sensitive data was being stored in an unsecured Amazon Web Services AWS S3 bucket during a cloud-security audit, and it’s sharing the story to inspire other organizations to double-check their own systems. Researcher Aaron Phillips with VPN...

Inside Ireland’s Public Healthcare Ransomware Scare

The consulting firm PricewaterhouseCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Irelands public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the...

GHSA-35RF-V2JV-GFG7 Privilege escalation to cluster admin on multi-tenant environments

Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run kubectl commands under the Service Account of kustomize-controlle...

Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting

The plugin does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Put the following payload in the Data ID setting of the plugin...

Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting

The plugin does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the Data ID setting of the plugin...

AuraBorealisApp - Do You Know What's In Your Python Packages? A Tool For Visualizing Python Package Registry Security Audit Data

AuraBorealis is a web application for visualizing anomalous and potentially malicious code in Python package registries. It uses security audit data produced by scanning the Python Package Index PyPI via Aura, a static analysis designed for large scale security auditing of Python packages. The...

Weak Password Vulnerability in Black Shield Network Security Audit System

Fujian Strait Information Technology Co., Ltd. is a state-controlled high-tech enterprises, specializing in network security technology field of technical research, product sales, information security services and other businesses. A weak password vulnerability exists in the Black Shield Network...

CVE-2021-29978

Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN 2.3...

CVE-2021-29978

Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN 2.3...

Security feature bypass

Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN 2.3...

CVE-2021-29978

Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN 2.3...

CVE-2021-29978

CVE-2021-29978 affects Mozilla VPN in the 2.x line, with the vulnerability present in versions prior to 2.3. The NVD entry lists a critical 3.1 base score of 9.8 (network, no auth, user interaction none) and high impact to confidentiality, integrity, and availability. Multiple low-severity issues...

Weak password vulnerability in SAS security audit system

SAS Security Audit System is a fortress developed by Green Alliance Technology. SAS Security Audit System has a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2021-33689

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted...

CVE-2021-33689

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted...

Design/Logic Flaw

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted...