βΌ CVE-2022-1900 βΌ
π Read
via "National Vulnerability Database".
The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.π Read
via "National Vulnerability Database".
βΌ CVE-2022-2063 βΌ
π Read
via "National Vulnerability Database".
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.π Read
via "National Vulnerability Database".
βΌ CVE-2022-2064 βΌ
π Read
via "National Vulnerability Database".
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1761 βΌ
π Read
via "National Vulnerability Database".
The PeterΓΒ’Γ’β¬ÒβΒ’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1777 βΌ
π Read
via "National Vulnerability Database".
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1822 βΌ
π Read
via "National Vulnerability Database".
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Γ’β¬ΛprojectΓ’β¬β’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1773 βΌ
π Read
via "National Vulnerability Database".
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scriptingπ Read
via "National Vulnerability Database".
βΌ CVE-2022-1694 βΌ
π Read
via "National Vulnerability Database".
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.π Read
via "National Vulnerability Database".
βΌ CVE-2022-2061 βΌ
π Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1918 βΌ
π Read
via "National Vulnerability Database".
The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1779 βΌ
π Read
via "National Vulnerability Database".
The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1780 βΌ
π Read
via "National Vulnerability Database".
The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escapingπ Read
via "National Vulnerability Database".
βΌ CVE-2022-31041 βΌ
π Read
via "National Vulnerability Database".
Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.π Read
via "National Vulnerability Database".
βΌ CVE-2022-1781 βΌ
π Read
via "National Vulnerability Database".
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escapingπ Read
via "National Vulnerability Database".
βΌ CVE-2022-2067 βΌ
π Read
via "National Vulnerability Database".
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.π Read
via "National Vulnerability Database".
π1
βΌ CVE-2022-31400 βΌ
π Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field.π Read
via "National Vulnerability Database".
βΌ CVE-2022-2066 βΌ
π Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.π Read
via "National Vulnerability Database".
ποΈ Cybercriminals use reverse tunneling and URL shorteners to launch βvirtually undetectableβ phishing campaigns ποΈ
π Read
via "The Daily Swig".
New hacking technique allows threat actors to evade some of the most effective phishing countermeasuresπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Cybercriminals use reverse tunneling and URL shorteners to launch βvirtually undetectableβ phishing campaigns
New hacking technique allows threat actors to evade some of the most effective phishing countermeasures
π1
ποΈ Kaiser Permanente data breach exposed healthcare records of 70,000 patients ποΈ
π Read
via "The Daily Swig".
Health plan provider plays down ID theft fears after breach at Washington state divisionπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Kaiser Permanente data breach exposed healthcare records of 70,000 patients
Health plan provider plays down ID theft fears after breach at Washington state division
βΌ CVE-2022-1820 βΌ
π Read
via "National Vulnerability Database".
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Γ’β¬ΛtΓ’β¬β’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.π Read
via "National Vulnerability Database".
βΌ CVE-2022-30310 βΌ
π Read
via "National Vulnerability Database".
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesnΓΒ’Γ’β¬ÒβΒ’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.π Read
via "National Vulnerability Database".