Friday Squid Blogging: Squid Purse

Perfect for an evening out. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...

WordPress Web Stories plugin input validation error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

CVE-2022-3708

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

Server side request forgery (ssrf)

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

CVE-2022-3708

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

CVE-2022-3708 Web Stories <= 1.24.0 - Server Side Request Forgery

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

CVE-2022-3708 Web Stories <= 1.24.0 - Server Side Request Forgery

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

CVE-2022-3708

CVE-2022-3708 affects the WordPress Web Stories plugin prior to version 1.25.0, with SSRF arising from inadequate validation of the url parameter in the /v1/hotlink/proxy REST API. The vulnerability allows authenticated users to cause the web application to perform requests to arbitrary external/...

CVE-2022-3708 Web Stories <= 1.24.0 - Server Side Request Forgery

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

WordPress plugin Web Stories 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

PT-2022-23794 · WordPress · Web Stories

Name of the Vulnerable Software and Affected Versions: Web Stories plugin for WordPress versions up to, and including 1.24.0 Description: The issue arises from insufficient validation of URLs supplied via the url parameter in the "/v1/hotlink/proxy" REST API Endpoint. This allows authenticated...

WordPress Web Stories plugin <= 1.24.0 - Auth. Server-Side Request Forgery (SSRF) vulnerability

Auth. Server-Side Request Forgery SSRF vulnerability discovered by Aymen Borgi in the WordPress Web Stories plugin versions = 1.24.0. Solution Update the WordPress Web Stories plugin to the latest available version at least 1.25.0...

[Security Nation] Jeremi Gosney on the Psychology of Password Hygiene

!\Security Nation\ Jeremi Gosney on the Psychology of Password Hygienehttps://blog.rapid7.com/content/images/2022/10/securitynationlogo-1.jpg In this episode of Security Nation, Jen and Tod talk to renowned password security expert Jeremi Gosney about how we are all guilty of bad password...

Web Stories < 1.25.0 - Subscriber+ Server Side Request Forgery

The plugin does not validate the url parameter passed to the v1/hotlink/proxy REST endpoint, allowing any authenticated users to perform SSRF attacks...

Friday Squid Blogging: Squid Images

iStock has over 13,000 royalty-free images of squid. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...

Friday Squid Blogging: 14-foot Giant Squid Washes Ashore in Cape Town

Its an Architeuthis dux, the second this year. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...

Friday Squid Blogging: SQUID Acronym for Making Conscious Choices

I think the U is forced: SQUID consists of five steps: Stop, Question, Understand, Imagine, and Decide. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...

Friday Squid Blogging: Bathyteuthis berryi Holding Eggs

Image and video of a Bathyteuthis berryi carrying a few hundred eggs, taken at a depth of 4,650 feet. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

MAL-2022-7077 Malicious code in web-stories-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c1e3925ac0f54df5bf33bb5435dec7a99402fb15efaee68e850c3da40851bb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web-stories-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c1e3925ac0f54df5bf33bb5435dec7a99402fb15efaee68e850c3da40851bb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...