Stripo Inc: No rate limiting for subscribe email + lead to Cross origin misconfiguration

Summary: I found bypass no rate limiting using Access-Control-Allow-Origin: and look the response as 200 vulnerable No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions...

vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50939)

vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP of vBulletin 5.6.3. The vulnerability can be exploited to conduct cross-site scripting attacks via the "Pay to subscribe to email notifications" field in t...

CVE-2020-25033

The Blubrry subscribe-sidebar aka Subscribe Sidebar plugin 1.3.1 for WordPress allows subscribesidebar.php&status= reflected XSS...

CVE-2020-25033

The Blubrry subscribe-sidebar aka Subscribe Sidebar plugin 1.3.1 for WordPress allows subscribesidebar.php&status= reflected XSS...

CVE-2020-25033

The CVE-2020-25033 entry concerns the Blubrry Subscribe Sidebar WordPress plugin (version up to 1.3.1). The issue is a reflected XSS in subscribe_sidebar.php via the status parameter (e.g., ...?page=subscribe_sidebar.php&status=...), allowing script execution. Some sources label the flaw as authe...

CVE-2020-25033

The Blubrry subscribe-sidebar aka Subscribe Sidebar plugin 1.3.1 for WordPress allows subscribesidebar.php&status= reflected XSS...

WordPress Subscribe Sidebar plugin <= 1.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by ZeroAptitude in WordPress Subscribe Sidebar plugin versions = 1.3.1. Solution 2020-12-28 - we were unable to find a patched version of this plugin. Notice from WordPress.org: "This plugin has been closed as of June 23, 2020 a...

Subscribe Sidebar <= 1.3.1 - Authenticated Reflected Cross-Site Scripting

The 'status' GET parameter in subscribesidebar.php, which is displayed in the plugin's option page, is vulnerable to reflected XSS attacks. /wp-admin/options-general.php?page=subscribesidebar.php&status=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E...

PT-2020-15901 · Blubrry · Blubrry Subscribe-Sidebar Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry subscribe-sidebar plugin version 1.3.1 Description: The issue allows for reflected XSS in the subscribe-sidebar.php file. This can be exploited through the status parameter. Recommendations: For version 1.3.1, update to a newer versio...

Subscribe Sidebar <= 1.3.1 - Authenticated Reflected Cross-Site Scripting

The 'status' GET parameter in subscribesidebar.php, which is displayed in the plugin's option page, is vulnerable to reflected XSS attacks. PoC /wp-admin/options-general.php?page=subscribesidebar.php=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E...

Debian DLA-2315-1 : gupnp security update

Yunus adrc found an issue in the SUBSCRIBE method of UPnP, a network protocol for devices to automatically discover and communicate with each other. Insuficient checks on this method allowed attackers to use vulnerable UPnP services for DoS attacks or possibly to bypass firewalls. For Debian 9...

[SECURITY] [DLA 2315-1] gupnp security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2315-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort August 06, 2020 https://wiki.debian.org/LTS -...

BSA-2020-1028

Security Advisory ID : BSA-2020-1028 Component : Call Stranger Revision : 1.0: Final A vulnerability in the UPnP SUBSCRIBE capability permits an attacker to send large amounts of data to arbitrary destinations accessible over the Internet, which could lead to a Distributed Denial of Service DDoS,...

UPnP denial of service vulnerability

UPnP is a Universal Plug and Play protocol from the Open Connectivity Foundation. A security vulnerability exists in versions of UPnP prior to 2020-04-17. An attacker could exploit the vulnerability by sending traffic to an arbitrary location with the help of the SUBSCRIBE feature, resulting in a...

Improper Access Control

Overview faye is a simple pub/sub messaging for the web. Affected versions of this package are vulnerable to Improper Access Control. The Server parses channels in a way that means any channel namespaced under /meta/subscribe will also work as a subscription request. For example if the client sen...

The vulnerability of the Eclipse Mosquitto messaging broker, related to insufficient checking of exclusive states, allows a hacker to trigger a service failure.

The vulnerability of the Eclipse Mosquitto messaging broker is related to insufficient checking of exceptional states. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a SUBSCRIBE packet containing approximately 65,400 or more characters '/'...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22191)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue. An attacker could exploit the...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22189)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue ISIQ that stems from the program's...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22186)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue ISIQ that stems from the program failin...

User Survey 2020 Report Shows Rapid Growth In Apache Pulsar Adoption

For the first time ever, the Apache Pulsar PMC team is publishing a user survey report. The 2020 Apache Pulsar User Survey Report reveals Pulsar's accelerating rate of global adoption, details how organizations are leveraging Pulsar to build real-time streaming applications, and highlights key...