‼ CVE-2022-0593 ‼
📖 Read
via "National Vulnerability Database".
The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0703 ‼
📖 Read
via "National Vulnerability Database".
The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0399 ‼
📖 Read
via "National Vulnerability Database".
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22735 ‼
📖 Read
via "National Vulnerability Database".
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0684 ‼
📖 Read
via "National Vulnerability Database".
The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0449 ‼
📖 Read
via "National Vulnerability Database".
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24996 ‼
📖 Read
via "National Vulnerability Database".
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0648 ‼
📖 Read
via "National Vulnerability Database".
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0248 ‼
📖 Read
via "National Vulnerability Database".
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24575 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41952 ‼
📖 Read
via "National Vulnerability Database".
Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22734 ‼
📖 Read
via "National Vulnerability Database".
The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24574 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0702 ‼
📖 Read
via "National Vulnerability Database".
The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24577 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen ().📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0327 ‼
📖 Read
via "National Vulnerability Database".
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0946 ‼
📖 Read
via "National Vulnerability Database".
Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24576 ‼
📖 Read
via "National Vulnerability Database".
GPAC 1.0.1 is affected by Use After Free through MP4Box.📖 Read
via "National Vulnerability Database".
⚠ Cryptocoin ATMs ruled illegal – “Shut down at once”, says regulator ⚠
📖 Read
via "Naked Security".
If you live in the UK and hadn't yet heard of cryptocoin ATMs... it's too late now!📖 Read
via "Naked Security".
Naked Security
Cryptocoin ATMs ruled illegal – “Shut down at once”, says regulator
If you live in the UK and hadn’t yet heard of cryptocoin ATMs… it’s too late now!
🕴 Mobile Threats Skyrocket 🕴
📖 Read
via "Dark Reading".
A new report shows an explosion of zero-day attacks and malware focused on mobile devices just as companies adopted widespread bring-your-own device policies.📖 Read
via "Dark Reading".
Dark Reading
Mobile Threats Skyrocket
A new report shows an explosion of zero-day attacks and malware focused on mobile devices just as companies adopted widespread bring-your-own device policies.
‼ CVE-2021-39051 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.📖 Read
via "National Vulnerability Database".