WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin Stop Spammers in versions prior to 2021.9 th...

CVE-2021-24245 Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue...

CVE-2021-24245

The CVE-2021-24245 entry pertains to the WordPress Stop Spammers plugin (pre-2021.9). A reflected XSS exists because the plugin does not properly escape user input when blocking requests, outputting the input in an attribute after filtering HTML tags. This leads to potential script injection in p...

PT-2021-15788

Name of the Vulnerable Software and Affected Versions Stop Spammers WordPress plugin versions prior to 2021.9 Description The issue arises from insufficient escaping of user input when blocking requests, such as matching a spam word. This leads to a reflected Cross-Site Scripting issue because th...

CVE-2021-24245: Improper Neutralization of Input During Web Page Generation

The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue...

GHSA-7H8X-WMQ2-7MFF Command injection in launchpad

All versions of package launchpad are vulnerable to Command Injection via stop...

Command injection in launchpad

All versions of package launchpad are vulnerable to Command Injection via stop...

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

The plugin did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. PoC From an IP not in the Allow List...

WordPress Stop Spammers plugin <= 2021.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Hoseinvita in WordPress Stop Spammers plugin versions = 2021.8. Solution Update the WordPress Stop Spammers plugin to the latest available version at least 2021.9...

CVE-2021-21627

A cross-site request forgery CSRF vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains...

CVE-2021-21627: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains...

Apache Tomcat <= 5.5.25 CSRF Vulnerability - Linux

Apache Tomcat is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

Remote Code Execution (RCE)

launchpad is vulnerable to remote code execution RCE. The vulnerability exists through execcommand in the stop function...

CVE-2021-23330

All versions of package launchpad are vulnerable to Command Injection via stop...

CVE-2021-23330

All versions of package launchpad are vulnerable to Command Injection via stop...

CVE-2021-23330 Command Injection

All versions of package launchpad are vulnerable to Command Injection via stop...

CVE-2021-23330

All versions of package launchpad are vulnerable to Command Injection via stop...

PT-2021-15439

Name of the Vulnerable Software and Affected Versions launchpad versions all Description The issue concerns Command Injection via the stop function. Recommendations For all versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability...

Bitovi Launchpad Command Injection Vulnerability

Bitovi Launchpad is a Javscript-based software from Bitovi Canada that provides native browser functionality for Mac Os, Windows, and Linuxlike. A command injection vulnerability exists in all versions of launchpad that allows injection via the stop command...

Android App "ELECOM File Manager" vulnerable to directory traversal

Overview Android App "ELECOM File Manager" provided by ELECOM CO.,LTD. contains a directory traversal vulnerability CWE-22 due to a flaw in the processing of the filenames when extracting the compressed files. Ryohei Koike reported this vulnerability to IPA. JPCERT/CC coordinated with the develop...