bluez: Passkey Entry protocol of the Bluetooth Core is vulnerable to an impersonation attack

A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing SSP, Secure Connections SC and LE Secure Connections LESC of the Bluetooth Core Specification is vulnerable to an impersonation attack where an active attacker can impersonate the initiating device...

Ddosify - High-performance Load Testing Tool

Features Protocol Agnostic - Currently supporting HTTP, HTTPS, HTTP/2. Other protocols are on the way. Scenario-Based - Create your flow in a JSON file. Without a line of code! Different Load Types - Test your system's limits across different load types. Installation ddosify is available via...

CVE-2021-24698

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download...

CVE-2021-24693

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the...

CVE-2021-24695

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

CVE-2021-24697

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1 sdmactivetab GET parameter and 2 sdmstatsstartdate/sdmstatsenddate POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

Authentication flaw

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

CVE-2021-24698

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download...

CVE-2021-24698

CVE-2021-24698 affects the WordPress plugin Simple Download Monitor prior to version 3.9.6. The issue is an access-control weakness that lets users with a low role (as low as Contributor) remove thumbnails from downloads they do not own, without being able to edit those downloads. Affected compon...

CVE-2021-24697

The CVE-2021-24697 entry concerns the WordPress Simple Download Monitor plugin prior to 3.9.5. The vulnerability is a reflected XSS caused by insufficient escaping of the sdm_active_tab (GET) and sdm_stats_start_date/sdm_stats_end_date (POST) parameters when echoed back in HTML attributes. Affect...

CVE-2021-24695 Simple Download Monitor < 3.9.6 - Unauthenticated Log Access

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

CVE-2021-24695

Summary: The Simple Download Monitor WordPress plugin (before 3.9.6) stores logs in a predictable location and lacks authentication/authorization, allowing unauthenticated users to download and read logs that contain sensitive information (IP addresses, usernames). What’s affected: WordPress plug...

CVE-2021-24693 Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the...

CVE-2021-24693

The CVE pertains to WordPress Simple Download Monitor plugin versions before 3.9.5. The vulnerability is a Stored Cross-Site Scripting (XSS) in the File Thumbnail post meta output, exploitable by users with as little as Contributor role. The underlying issue is lack of escaping the File Thumbnail...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. The WordPress plugin suffers from a cross-site scripting...

PT-2021-16200 · WordPress · Simple Download Monitor

Name of the Vulnerable Software and Affected Versions: Simple Download Monitor WordPress plugin versions prior to 3.9.6 Description: The issue allows unauthenticated users to download and read logs containing sensitive information, such as IP addresses and usernames, due to the logs being saved i...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor version 3.9.5 before the cross-site scripting vulnerability, the vulnerability stems from...

Simple Client Management System 1.0 Cross Site Scripting

Exploit Title: Simple Client Management System 1.0 - 'multiple' Stored Cross-Site Scripting XSS Exploit Author: Sentinal920 Date: 5-11-2021 Category: Web application Vendor Homepage: https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html Software Link:...

WordPress 插件访问控制错误漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor...

Simple Client Management System 1.0 - (multiple) Stored Cross-Site Scripting Vulnerability

Exploit Title: Simple Client Management System 1.0 - 'multiple' Stored Cross-Site Scripting XSS Exploit Author: Sentinal920 Category: Web application Vendor Homepage: https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html Software Link:...