CVE-2020-35949

The CVE-2020-35949 entry concerns the WordPress plugin Quiz and Survey Master before 7.0.1. Affected component: file upload handler in quiz questions. Root cause: only Content-Type is validated during upload, allowing unauthenticated attackers to upload arbitrary files (e.g., .php as text/plain) ...

CVE-2020-35951

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurre...

CVE-2020-35951

CVE-2020-35951 affects the WordPress plugin Quiz and Survey Master in versions prior to 7.0.1. The issue is an arbitrary file deletion vulnerability: the function qsm_remove_file_fd_question can delete arbitrary files (e.g., wp-config.php) unauthenticated, potentially taking the site offline and ...

CVE-2020-35951

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurre...

CVE-2020-35949: Unrestricted Upload of File with Dangerous Type

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checke...

CVE-2020-35951: Missing Authentication for Critical Function

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurre...

PT-2021-11883

Name of the Vulnerable Software and Affected Versions: Quiz and Survey Master plugin versions prior to 7.0.1 for WordPress Description: An issue in the Quiz and Survey Master plugin allows users to delete arbitrary files, such as the wp-config.php file, which could take a site offline and allow a...

PT-2021-11881

Name of the Vulnerable Software and Affected Versions: Quiz and Survey Master plugin versions prior to 7.0.1 Description: An issue in the Quiz and Survey Master plugin allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. This is possible when a...

CVE-2020-25799

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser...

Cross site scripting

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser...

CVE-2020-25799

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser...

CVE-2020-25799: Improper Neutralization of Input During Web Page Generation

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser...

WordPress Quiz and Survey Master plugin security vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the Quiz and Survey Master plugin before 7.0.1 for WordPress that...

PT-2020-16219 · Limesurvey · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey version 3.21.1 Description: The issue affects the Quota component of the Survey page, where cross-site scripting XSS can occur. When an administrative user views the survey quota, JavaScript code will be executed in the browser...

LimeSurvey 跨站脚本漏洞

limesurvey is an open source online questionnaire program with many functions such as questionnaire design, modification, release, recovery and statistics. A cross-site scripting vulnerability exists in the "Quota" component of the "Survey" page in LimeSurvey 3.21.1. An attacker can exploit this...

WordPress Quiz and Survey Master plugin 安全漏洞

WordPress is a blogging platform developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Quiz and Survey Master plugin is a plugin in WordPress. An arbitrary file upload vulnerability exis...

CISA Releases Free Detection Tool for Azure/M365 Environment

CISA has created a free tool for detecting unusual and potentially malicious activity that threatens users and applications in an Azure/Microsoft O365 environment. The tool is intended for use by incident responders and is narrowly focused on activity that is endemic to the recent identity- and...

Launching a New Game Studio and Planning for Growth

So, you're starting your own game studio. This is an incredible opportunity! You and your team get to start fresh and build the game of your dreams! But, let's be honest, if you have just founded your own game studio, odds are that you're not a technical architect. You may have some technical...

Data Privacy – Now’s the Time for the US to Catch Up

The recent Netflix documentary, The Social Dilemma, may have highlighted to many Americans just what happens to the wealth of personal information they regularly - and willingly - share online. It may be especially concerning, then, to know that companies in the United States aren’t required by...

CISA Updates Alert and Releases Supplemental Guidance on Emergency Directive for SolarWinds Orion Compromise

CISA has updated AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations, originally released December 17. This update states that CISA has evidence of, and is currently investigating, initial access vectors in addition to...