Joshua Chan

An improper neutralization of HTTP headers for scripting syntax allows a remote attacker to manipulate the `Host` header. This can result in the redirection of firewall management users to arbitrary web domains.

The issue allows retrieval of embedded sensitive data due to the generation of error messages containing sensitive information.

The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability in WP Go Maps, formerly known as WP Google Maps. This vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to.

The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions or data theft.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability in Capa Wp-Scribd-List, which allows Stored XSS.

The issue is related to the public accessibility of the print php information.php file, which allows unauthenticated attackers to extract sensitive configuration data. This information can be used in further attacks.

The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS, where an attacker can inject malicious scripts into the website. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue allows unauthenticated attackers to extract configuration data via the cf7adn-info.php file, which can be used to aid in other attacks. This is possible due to an Information Exposure vulnerability in the plugin.

Name of the Vulnerable Software and Affected Versions: Sanjay Singh Negi Floating Video Player versions 1.0 and earlier Description: The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentially leading to the execution of malicious scripts stored on the server. Recommendations: For Sanjay Singh Negi Floating Video Player versions 1.0 and earlier, update to a version that fixes the CSRF vulnerability to prevent Stored XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WP-NERD Toolkit versions n/a through 1.1 Description: The issue is related to the exposure of sensitive system information to an unauthorized control sphere. This problem affects the WP-NERD Toolkit, allowing unauthorized access to confidential system information. Recommendations: For WP-NERD Toolkit versions n/a through 1.1, update to a version later than 1.1 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

The issue is related to arbitrary file uploads due to missing file type validation in the `process uploaded files` function. This allows authenticated attackers with Administrator-level access and above to upload arbitrary files on the affected site's server, potentially making remote code execution possible.

Name of the Vulnerable Software and Affected Versions: Import Export For WooCommerce versions 1.5 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and potential system compromise. Recommendations: For versions 1.5 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows unauthenticated attackers to extract configuration information through the cf7sa-info.php file, which returns phpinfo() data. This information can be leveraged in another attack.

The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. This can be exploited in the Stripe Payments component of Tips and Tricks HQ, wptipsntricks.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also store malicious scripts that can be executed by other users.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentially leading to the execution of malicious scripts stored on the server.

The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. This is due to a vulnerability in the IDE Interactive Content Audit Exporter.

The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS, where an attacker can inject malicious scripts into the website, which are then stored and executed by the website.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that also allows Cross-Site Scripting (XSS). This means an attacker could potentially trick a user into performing unintended actions on the web application, and also inject malicious scripts into the website.