WordPress plugin Amazon Associate Filter 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2024-10311

The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edbaadminhandle' function. This makes it possible for authenticated attackers, with subscriber-level permissions...

WordPress plugin External Database Based Actions 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin...

PT-2024-35215 · Labs64 · Digipass

Name of the Vulnerable Software and Affected Versions: DigiPass versions 0.3.0 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows Absolute Path Traversal in Labs64 DigiPass. Recommendations:...

WordPress plugin Widget or Sidebar Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

WordPress Widget or Sidebar Shortcode plugin <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by theviper17y in WordPress Plugin Widget or Sidebar Shortcode versions = 0.6.1...

PYSEC-2024-299

Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block...

FreeCoAP 安全漏洞

FreeCoAP is a C implementation of the CoAP server, client, and HTTP/CoAP proxy by Keith Cullen, a private developer. A security vulnerability exists in FreeCoAP version 0.7, which stems from a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code or cause a...

CVE-2024-31197

Improper Null Termination vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::of10::Port:unpack. This issue affects libfluid: 0.1.0...

PT-2024-23827 · Open Networking Foundation · Libfluid

Name of the Vulnerable Software and Affected Versions: libfluid version 0.1.0 Description: The issue is related to an Unchecked Return Value to NULL Pointer Dereference vulnerability in the libfluid msg module of the Open Networking Foundation ONF libfluid. This vulnerability is associated with t...

PT-2024-20172

Name of the Vulnerable Software and Affected Versions libfluid version 0.1.0 Description The issue is related to an Unchecked Return Value to NULL Pointer Dereference vulnerability in the Open Networking Foundation ONF libfluid, specifically in the libfluid msg module. This vulnerability is...

WordPress Posts reminder plugin <= 0.20 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Posts reminder versions = 0.20...

CVE-2024-42475 OAuth library for nim allows insecure generation of state values by generateState - entropy too low and uses regular PRNG instead of CSPRNG

In the OAuth library for nim prior to version 0.11, the state values generated by the generateState function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, associating the user's session with the attacker's protected...

filestash 安全漏洞

filestash is a Dropbox-like file manager by the individual developer Mickael. A security vulnerability exists in filestash v0.4, which stems from a TLS certificate validation being skipped when using the FTPS protocol. An attacker can perform a man-in-the-middle attack via the Init function of...

mini-deep-assign 安全漏洞

mini-deep-assign is a library by Alexander Personal Developer. A security vulnerability exists in mini-deep-assign version v0.0.8. An attacker can exploit this vulnerability to execute arbitrary code or cause a denial of service and other impact via the assign method at /lib/index.js:91...

SUSE CVE-2024-40971

In the Linux kernel, the following vulnerability has been resolved: f2fs: remove clear SBINLINECRYPT flag in defaultoptions In f2fsremount, SBINLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead t...

Malicious code in sap-ans (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 039a7fc0556d340f2ad4abfec6c8573743803edbe7e104947364c0332716d7c5 The OpenSSF Package Analysis project identified 'sap-ans' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in sap-authchildform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7050cc78b5ef30972e144f1f4e3f3af6bd67899aec66977a7395a0a35a529d4b The OpenSSF Package Analysis project identified 'sap-authchildform' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-allusers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d5eacfc5bc68ef30f29755795ed8ff32a858d41764d8e98b1e3e4525fe339f04 The OpenSSF Package Analysis project identified 'sap-allusers' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Gogs Security Breach

Gogs Go Git Service is a self-service Git hosting service based on the Go language by the GOGS team, which supports creating and migrating public/private repositories, adding and deleting repository collaborators, and so on. A security vulnerability exists in Gogs version 0.13.0, which stems from...