Archery SQL注入漏洞

Archery is a set of open source vulnerability assessment and management tools. A security vulnerability exists in Archery versions v1.8.3 through v1.8.5, which stems from the starttime and stoptime parameters in the my2sql interface containing SQL injection vulnerabilities...

CVE-2022-1663

The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...

CVE-2022-1663

The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...

CVE-2022-1663

CVE-2022-1663 describes an information-disclosure/credential-bypass issue in the WordPress Stop Spam Comments plugin (versions ≤ 0.2.1.2). The vulnerability stems from improper generation of the Javascript access token (ssc_key) intended to prevent abuse of the comment section, allowing an attack...

WordPress plugin Stop Spam Comments 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

PT-2022-14032 · WordPress · Stop Comment Spam

Name of the Vulnerable Software and Affected Versions: Stop Spam Comments WordPress plugin versions 0.2.1.2 and earlier Description: The issue arises from the improper generation of the Javascript access token, which is intended to prevent abuse of the comment section. This allows threat authors ...

Malicious code in gulpreplae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7186692889cc7ad37d17f2278a3973c92dc0d3a45dca16d95bdcdbfbcc995d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Stop Spam Comments <= 0.2.1.2 - Access Token Bypass

The plugin does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request. Collect the name and value of ssckey for the target post and use it on the request. curl...

WordPress Stop Spam Comments plugin <= 0.2.1.2 - Access Token Bypass vulnerability

Access Token Bypass vulnerability discovered by Daniel Ruf in WordPress Stop Spam Comments plugin versions = 0.2.1.2. Solution Deactivate and delete. This plugin has been closed as of August 3, 2022 and is not available for download. This closure is temporary, pending a full review...

Multiple vulnerabilities in Nintendo Wi-Fi Network Adaptor WAP-001

Overview Nintendo Wi-Fi Network Adaptor provided by Nintendo Co.,Ltd. contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2022-36381 Buffer overflow CWE-121 - CVE-2022-36293 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc reported these vulnerabilities to IP...

CVE-2022-29951

JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol configurable on ports 1024-65534 on either TCP or UDP for a wide variety of engineering purposes such as starting and stopping the PLC, downloading and uploading projects, and changing...

CLSA-2022-1658171278 Fixed 7 CVEs in vim

CVE-2022-2206: adjust cmdlinerow and msgrow to the value of Rows - CVE-2022-2284: stop visual mode when closing a window - CVE-2022-2285: put a NUL after the typeahead - CVE-2022-2286: check the length of the string - CVE-2022-2287: disallow adding a word with control characters or a trailing...

Honeywell Alerton Visual Logic 安全漏洞

The Honeywell Alerton Visual Logic is a communication sensor/controller from USAHoneywell. with a built-in humidity sensor and optional wireless capability. A security vulnerability exists in Honeywell Alerton Visual Logic versions 2022-05-04 and earlier, which can be exploited by an attacker to...

stop-sekta.kz Cross Site Scripting vulnerability OBB-2756462

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Vulnerability of the /admin/service/stop/ component of the TrueConf Server software, which allows a attacker to perform a CSRF attack

The vulnerability of the /admin/service/stop/ component of the TrueConf Server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack remotely...

CVE-2017-20120

A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

Malicious code in cro-staking (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff0f0850bf22374744499697efcbb4c429178c55a7c05dc53cdff7e59f3ce871 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idmsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d0b1a3d0d627a0646c7fbfa5441aa70a41921ab6965e74fb89215a0368b9243 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 13-pkg-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d11ff8eabd16040bbd151481a728945ea4c50fe74433a661598e30c0d635d26c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in upholdsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b5a834d231fb9a9771dae82fc2a4203d704b9f006616359270894edaba9cae3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...