CVE-2024-51845

CVE-2024-51845 affects Richteam Share Buttons – Social Media (WordPress plugin). The issue is an improper neutralization of input in an SQL command, enabling Blind SQL Injection in the affected component/file path. Affected versions are from n/a up to 1.0.2. Default CVSS v3.1 base score is 8.5 (H...

CVE-2024-51845 WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through = 1.0.2...

WordPress plugin Share Buttons – Social Media SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress plugin Share Buttons - Social Media version 1.0....

PT-2024-34973 · Unknown · Richteam Share Buttons – Social Media

Name of the Vulnerable Software and Affected Versions: Richteam Share Buttons – Social Media versions 1.0.2 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection', which allows Blind SQL Injection. This...

WordPress Simple Social Share Block plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Simple Social Share Block versions = 1.0.0...

WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Share Buttons – Social Media versions = 1.0.2...

WordPress Simple Social Share Block Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Simple Social Share Block Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51865 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8b3f455be888 Credits SOPROBRO Required privilege...

WordPress Share Buttons – Social Media Plugin <= 1.0.2 is vulnerable to SQL Injection

Software Share Buttons – Social Media Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-51845 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID c8254280abdb Credits LVT-tholv2k Required privilege...

CVE-2024-10668

There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk ...

CVE-2024-10668

CVE-2024-10668 affects Google Quick Share for Windows prior to version 1.0.2002.2. Root cause: when a Payload Transfer frame of type FILE is received, the file is written to Downloads and Quick Share normally deletes unknown files; however, sending two Payload Transfer frames with the same payloa...

CVE-2024-9946 Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it...

CVE-2024-51005

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sharename parameter at usbremotesmbconf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-50995

Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sharename parameter at usbremotesmbconf.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-10687 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient...

Crooks bank on Microsoft&#8217;s search engine to phish customers

We identified a new wave of phishing for banking credentials that targets consumers via Microsoft's search engine. A Bing search query for 'Keybank login' currently returns malicious links on the first page, and sometimes as the top search result. We have reported the fraudulent sites to Microsof...

PT-2024-8390 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a command injection vulnerability in the share name parameter at the "usb remote smb conf.cgi" endpoint. This vulnerability allows attackers to execute arbitrary OS commands...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems from the U.S.-based Apple Inc. developed specifically for Mac computers. A security vulnerability exists in Apple macOS version 15, which stems from the fact that an attacker with physical access may be able to share items from the lock scre...

The vulnerability in the `usb_remote_smb_conf.cgi` script of NETGEAR XR1000 Wi-Fi routers allows a hacker to execute arbitrary commands.

The vulnerability in the usbremotesmbconf.cgi script of NETGEAR XR1000 Wi-Fi routers lies in the lack of measures for sanitizing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the sharename parameter...

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

Summary The Butterfly framework uses the java.net.URL class to refer to what are expected to be local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local file. However, if a file:/ URL is directly given where a relative path resource name is...

CVE-2024-9219

The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.19. This makes it possible for unauthenticated attackers to inject arbitrary web...