CVE-2022-29414

The CVE-2022-29414 entry concerns WordPress Subscribe To Comments Reloaded plugin (

CVE-2022-29414

Multiple 13x Cross-Site Request Forgery CSRF vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin mass update settings, manage subscriptions add a new subscription, update subscription, delete Subscription...

WordPress WP Subscribe plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas Patchstack Alliance in WordPress WP Subscribe plugin versions = 1.2.12. Solution Update the WordPress WP Subscribe plugin to the latest available version at least 1.2.13...

WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities discovered by Ex.Mi Patchstack in WordPress Subscribe To Comments Reloaded plugin versions = 211130. Solution Update the WordPress Subscribe To Comments Reloaded plugin to the latest available version at least 220502...

WordPress plugin Subscribe To Comments Reloaded 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Subscribe To Comments Reloaded plugin 211130 and earlier versions are vulnerable to cross-site...

GSD-2022-1002242 RDMA/mlx5: Fix memory leak in error flow for subscribe event routine

RDMA/mlx5: Fix memory leak in error flow for subscribe event routine This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...

GSD-2022-1001521 RDMA/mlx5: Fix memory leak in error flow for subscribe event routine

RDMA/mlx5: Fix memory leak in error flow for subscribe event routine This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001205 RDMA/mlx5: Fix memory leak in error flow for subscribe event routine

RDMA/mlx5: Fix memory leak in error flow for subscribe event routine This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

CometD 安全漏洞

CometD is an extensible WebSocket and HTTP-based event and message routing bus for the CometD community. A security vulnerability in CometD in any version prior to 5.0.11, 6.0.6, and 7.0.6 stems from the fact that internal use of the Oort and Seti channels is not properly authorized, so any remot...

WordPress Multilist Subscribe for Sendy plugin <= 1.6.1 - Subscriber+ Arbitrary Options Update vulnerability

Subscriber+ Arbitrary Options Update vulnerability discovered by 0xdecafbad in WordPress Multilist Subscribe for Sendy plugin versions = 1.6.1. Solution Deactivate and delete. This plugin has been closed as of February 1, 2022 and is not available for download. This closure is temporary, pending ...

Multilist Subscribe for Sendy <= 1.6.1 - Subscriber+ Arbitrary Options Update

The plugin is using an outdated version of the Freemius library 1.2.2.9, which is known to be affected by a security issue allowing any authenticated users, such as subscriber to set arbitrary blog options PoC As any authenticated user: Enable new user registrations:...

Multilist Subscribe for Sendy <= 1.6.1 - Subscriber+ Arbitrary Options Update

The plugin is using an outdated version of the Freemius library 1.2.2.9, which is known to be affected by a security issue allowing any authenticated users, such as subscriber to set arbitrary blog options As any authenticated user: Enable new user registrations:...

WordPress Multilist Subscribe for Sendy plugin <= 1.6.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Multilist Subscribe for Sendy plugin versions = 1.6.1. Solution No patched version available...

CVE-2021-24923

The CVE-2021-24923 issue affects the Sendinblue Newsletter, SMTP, Email marketing and Subscribe forms WordPress plugin, pre-3.1.25. The root cause is improper escaping of the sib-statistics-date parameter when it is output in an HTML attribute, leading to a Reflected Cross-Site Scripting (XSS) vu...

CVE-2021-24923 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...

WordPress WP Optin Wheel plugin <= 1.3.4 - Subscribe+ Plugin Options Update (Toggle Wheel status, Update wheels) vulnerability

Subscribe+ Plugin Options Update Toggle Wheel status, Update wheels vulnerability discovered in WordPress WP Optin Wheel plugin versions = 1.3.4. Solution Update the WordPress WP Optin Wheel plugin to the latest available version at least 1.3.5...

Beers with Talos, Ep. #114: And then there were two...

Beers with Talos BWT Podcast episode No. 114 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherRecorded Dec. 9, 2021. If iTunes and Google Play aren't your thing, click here. We joked... This is only the beginning! Please vis...

WordPress Newsletter, SMTP, Email marketing and Subscribe plugin <= 3.1.30 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Newsletter, SMTP, Email marketing and Subscribe plugin versions = 3.1.30. Solution Update the WordPress Newsletter, SMTP, Email marketing and Subscribe plugin to the latest available version at least 3.1.31...

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS

The plugin does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC...

WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin <= 3.1.24 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin versions = 3.1.24. Solution Update the WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin to the latest available...