WordPress Extend Filter Products By Price Widget plugin <= 1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Extend Filter Products By Price Widget plugin versions = 1.0. Solution No patched version available...

WordPress Hire Me Widget plugin <= 1.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Hire Me Widget plugin versions = 1.0.4. Solution Update the WordPress Hire Me Widget plugin to the latest available version at least 1.0.5...

WordPress Widget Detector for Elementor plugin < 1.2.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Widget Detector for Elementor plugin versions 1.2.0. Solution Update the WordPress Widget Detector for Elementor plugin to the latest available version at least 1.2.0...

WordPress Hire Me Widget plugin <= 1.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Hire Me Widget plugin versions = 1.0.4. Solution Update the WordPress Hire Me Widget plugin to the latest available version at least 1.0.5...

WordPress Widget Detector for Elementor plugin < 1.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Widget Detector for Elementor plugin versions 1.2.0. Solution Update the WordPress Widget Detector for Elementor plugin to the latest available version at least 1.2.0...

WordPress Rating Widget plugin < 3.1.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Rating Widget plugin versions 3.1.4. Solution Update the WordPress Rating Widget plugin to the latest available version at least 3.1.4...

WordPress Video Reviews / Video Widget plugin <= 1.2.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Video Reviews / Video Widget plugin versions = 1.2.2. Solution Update the WordPress Video Reviews / Video Widget plugin to the latest available version at least 1.2.3...

WordPress Tabs with Recommended Posts (Widget) plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Tabs with Recommended Posts Widget plugin versions = 1.0.0. Solution No patched version available...

WordPress Rating Widget plugin < 3.1.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Rating Widget plugin versions 3.1.4. Solution Update the WordPress Rating Widget plugin to the latest available version at least 3.1.4...

WordPress Blog Sidebar Widget plugin <= 1.0.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Blog Sidebar Widget plugin versions = 1.0.5. Solution No patched version available...

WordPress Blog Sidebar Widget plugin <= 1.0.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Blog Sidebar Widget plugin versions = 1.0.5. Solution No patched version available...

WordPress Simple Social Page Widget & Shortcode plugin <= 1.7.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Simple Social Page Widget & Shortcode plugin versions = 1.7.0. Solution No patched version available...

WordPress Video Reviews / Video Widget plugin <= 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Video Reviews / Video Widget plugin versions = 1.2.2. Solution Update the WordPress Video Reviews / Video Widget plugin to the latest available version at least 1.2.3...

WordPress Responsive Social Slider Widget plugin <= 1.5.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Responsive Social Slider Widget plugin versions = 1.5.3. Solution No patched version available...

WordPress Simple Social Page Widget & Shortcode plugin <= 1.7.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Simple Social Page Widget & Shortcode plugin versions = 1.7.0. Solution No patched version available...

MSTICPy January 2022 hackathon highlights

During the month of January 2022, the Microsoft Threat Intelligence Center MSTIC ran its inaugural hackathon for the open-source Jupyter and Python Security Tools library, MSTICPy. We asked the security community for their contributions to expand and improve MSTICPy’s features and capabilities, a...

DRUPAL-CONTRIB-2022-026

This module provides an entity relationship hierarchy tree widget for an entity reference field. The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to...

Entity Reference Tree Widget - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-026

This module provides an entity relationship hierarchy tree widget for an entity reference field. The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to...

Cross-site Scripting (XSS)

openmct is vulnerable to cross-site scripting. The library does not properly escape the URL field in the Summary Widget element, allowing an attacker to inject and execute malicious javascript...

Cross-site Scripting (XSS)

openmct is vulnerable to cross-site scripting. The library does not properly escape the URL field in the Condition Widget element, allowing an attacker to inject and execute malicious javascript...