diff --git a/config.yml b/config.yml index 4773920..dabe0d6 100644 --- a/config.yml +++ b/config.yml @@ -65,7 +65,7 @@ params: imageTitle: Muhammad Daffa buttons: - name: Read More - url: profile + url: about # home-info mode # homeInfoParams: @@ -116,7 +116,7 @@ menu: main: - identifier: profile name: About - url: /profile/ + url: /about/ weight: 10 - identifier: portfolio name: Portfolio diff --git a/content/about/_index.md b/content/about/_index.md new file mode 100644 index 0000000..bf98c0c --- /dev/null +++ b/content/about/_index.md @@ -0,0 +1,23 @@ +--- +author: "Muhammad Daffa" +title: "About" +date: "2019-03-09" +# description: "About Muhammad Daffa" +tags: ["profile"] +TocOpen: true +draft: false +hidemeta: true +comments: false +searchHidden: true +ShowBreadCrumbs: false +ShowRssButtonInSectionTermList: false +--- + +## Muhammad Daffa +Hi! I'm Muhammad Daffa, you can call me Daffa. I started learning about cyber security between 2019 / 2020. I was interested in cybersecurity when my facebook friends posted about how they get money doing an activity called "bug bounty". From that post, I tried to learn more about cybersecurity, especially penetration testing on website + +Don't ever think I'm a professional penetration tester :D. There are still a lot of things about cyber security that I haven't learned, such as doing penetration testing on Android, iOS, or even on the network. Right now I'm learning about malware analysis too, thanks to TCM Security <3 + +## Contact +Contact me if you have something to discuss or if you have a great resource about cybersecurity, i'll be very happy to read about the resource :D +> Find my contact at the homepage diff --git a/content/achievements/_index.md b/content/achievements/_index.md new file mode 100644 index 0000000..762407d --- /dev/null +++ b/content/achievements/_index.md @@ -0,0 +1,37 @@ +--- +author: "Muhammad Daffa" +title: "Portfolio" +date: "2019-03-09" +# description: "About Muhammad Daffa" +tags: ["profile"] +TocOpen: true +draft: false +hidemeta: true +comments: false +searchHidden: true +ShowBreadCrumbs: false +ShowRssButtonInSectionTermList: false +--- + +Here are some of my achievements when doing bug hunting + +## Bug Bounties and Hall of Fame + +- [Sekolah Siber](https://sekolahsiber.com/hall-of-fame/) +- [Wageningen University & Research](https://www.wur.nl/en/about-wur/privacy-and-information-security/hall-of-fame-responsible-disclosure.htm) +- [PostNL Holding B.V](https://www.postnl.nl/en/responsible-disclosure) +- [Inflectra](https://www.inflectra.com/company/responsible-disclosure.aspx) +- [Legally Breaking](https://legallybreaking.com/index.php?p=/hall-fame) (Website Inactive) +- [PlanetArt](https://hackerone.com/planetart/thanks) +- [Yelp](https://hackerone.com/yelp/thanks) +- 2 Private Program at Hackerone + +## Certificate Appreciation + +- Axioo Class Program +- GeeksforGeeks +- Cambridge University +- Windesheim University +- Finansialku +- PixelNinja ID +- Bitrexgo (Website Inactive) diff --git a/content/blog/_index.md b/content/blog/_index.md new file mode 100644 index 0000000..c7d3f27 --- /dev/null +++ b/content/blog/_index.md @@ -0,0 +1,16 @@ +--- +author: "Muhammad Daffa" +title: "Blog" +date: "2019-03-09" +# description: "About Muhammad Daffa" +tags: ["profile"] +TocOpen: true +draft: false +hidemeta: true +comments: false +searchHidden: true +ShowBreadCrumbs: false +ShowRssButtonInSectionTermList: false +--- + +Coming Soon! Still in progress migrating from Medium to this website :) diff --git a/content/cve/CVE-2021-24519.md b/content/cve/CVE-2021-24519.md index 075597d..15ff7eb 100644 --- a/content/cve/CVE-2021-24519.md +++ b/content/cve/CVE-2021-24519.md @@ -17,7 +17,7 @@ disableHLJS: true # to disable highlightjs disableShare: false disableHLJS: false hideSummary: false -searchHidden: false +searchHidden: true ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true diff --git a/content/cve/CVE-2022-23983.md b/content/cve/CVE-2022-23983.md index 2279020..14eed50 100644 --- a/content/cve/CVE-2022-23983.md +++ b/content/cve/CVE-2022-23983.md @@ -9,19 +9,18 @@ author: "Muhammad Daffa" showToc: true TocOpen: true draft: false -hidemeta: false +hidemeta: true comments: false description: "WP Content Copy Protection & No Right Click < 3.4.5 - Settings Update via CSRF" canonicalURL: "https://canonical.url/to/page" -disableHLJS: true # to disable highlightjs +disableHLJS: false # to disable highlightjs disableShare: false -disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-23984.md b/content/cve/CVE-2022-23984.md index 707cedc..3a16f1a 100644 --- a/content/cve/CVE-2022-23984.md +++ b/content/cve/CVE-2022-23984.md @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-25618.md b/content/cve/CVE-2022-25618.md index 6372b4a..e7f7adc 100644 --- a/content/cve/CVE-2022-25618.md +++ b/content/cve/CVE-2022-25618.md @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-27844.md b/content/cve/CVE-2022-27844.md index c6c5b19..755d950 100644 --- a/content/cve/CVE-2022-27844.md +++ b/content/cve/CVE-2022-27844.md @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-27848.md b/content/cve/CVE-2022-27848.md index bf13078..b5e1762 100644 --- a/content/cve/CVE-2022-27848.md +++ b/content/cve/CVE-2022-27848.md @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-33201.md b/content/cve/CVE-2022-33201.md index 679ca32..385a1c4 100644 --- a/content/cve/CVE-2022-33201.md +++ b/content/cve/CVE-2022-33201.md @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-34347.md b/content/cve/CVE-2022-34347.md index 78474e9..79cb8e6 100644 --- a/content/cve/CVE-2022-34347.md +++ b/content/cve/CVE-2022-34347.md @@ -1,5 +1,5 @@ --- -title: "CVE-2021-24519" +title: "CVE-2022-34347" date: 2022-08-22T11:30:03+00:00 # weight: 1 # aliases: ["/first"] @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-36282.md b/content/cve/CVE-2022-36282.md index 1a56e23..034d5c5 100644 --- a/content/cve/CVE-2022-36282.md +++ b/content/cve/CVE-2022-36282.md @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-36340.md b/content/cve/CVE-2022-36340.md new file mode 100644 index 0000000..339f3a2 --- /dev/null +++ b/content/cve/CVE-2022-36340.md @@ -0,0 +1,54 @@ +--- +title: "CVE-2022-36340" +date: 2022-09-23T11:30:03+00:00 +# weight: 1 +# aliases: ["/first"] +tags: ["cve"] +author: "Muhammad Daffa" +# author: ["Me", "You"] # multiple authors +showToc: true +TocOpen: true +draft: false +hidemeta: true +comments: false +description: "WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion" +canonicalURL: "https://canonical.url/to/page" +disableHLJS: false # to disable highlightjs +disableShare: false +hideSummary: false +searchHidden: true +ShowReadingTime: false +ShowBreadCrumbs: true +ShowPostNavLinks: true +ShowWordCount: false +ShowRssButtonInSectionTermList: true +UseHugoToc: true +cover: + image: "" # image path/url + alt: "" # alt text + caption: "" # display caption under cover + relative: false # when using page bundles set this to true + hidden: true # only hide on current single page +# editPost: +# URL: "https://github.com//content" +# Text: "Suggest Changes" # edit text +# appendFilePath: true # to append file path to Edit link +--- +## Description +Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress. + +## Plugin Name +[Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin](https://wordpress.org/plugins/mailoptin/) + +## Installation Number +30,000+ + +## Affected Version +<= 1.2.49.0 + +## Fixed Version +1.2.50.0 + +## Advisory link + * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36340) + * [Patchstack](https://patchstack.com/database/vulnerability/mailoptin/wordpress-mailoptin-plugin-1-2-49-0-unauthenticated-optin-campaign-cache-deletion-vulnerability) diff --git a/content/cve/CVE-2022-36346.md b/content/cve/CVE-2022-36346.md index ed121ab..9299265 100644 --- a/content/cve/CVE-2022-36346.md +++ b/content/cve/CVE-2022-36346.md @@ -18,10 +18,10 @@ disableShare: false disableHLJS: false hideSummary: false searchHidden: true -ShowReadingTime: true +ShowReadingTime: false ShowBreadCrumbs: true ShowPostNavLinks: true -ShowWordCount: true +ShowWordCount: false ShowRssButtonInSectionTermList: true UseHugoToc: true cover: diff --git a/content/cve/CVE-2022-38095.md b/content/cve/CVE-2022-38095.md new file mode 100644 index 0000000..242c4d1 --- /dev/null +++ b/content/cve/CVE-2022-38095.md @@ -0,0 +1,54 @@ +--- +title: "CVE-2022-38095" +date: 2022-09-23T11:30:03+00:00 +# weight: 1 +# aliases: ["/first"] +tags: ["cve"] +author: "Muhammad Daffa" +# author: ["Me", "You"] # multiple authors +showToc: true +TocOpen: true +draft: false +hidemeta: true +comments: false +description: "WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery" +canonicalURL: "https://canonical.url/to/page" +disableHLJS: false # to disable highlightjs +disableShare: false +hideSummary: false +searchHidden: true +ShowReadingTime: false +ShowBreadCrumbs: true +ShowPostNavLinks: true +ShowWordCount: false +ShowRssButtonInSectionTermList: true +UseHugoToc: true +cover: + image: "" # image path/url + alt: "" # alt text + caption: "" # display caption under cover + relative: false # when using page bundles set this to true + hidden: true # only hide on current single page +# editPost: +# URL: "https://github.com//content" +# Text: "Suggest Changes" # edit text +# appendFilePath: true # to append file path to Edit link +--- +## Description +Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress. + +## Plugin Name +[Advanced Dynamic Pricing for WooCommerce](https://wordpress.org/plugins/advanced-dynamic-pricing-for-woocommerce/) + +## Installation Number +20,000+ + +## Affected Version +<= 4.1.3 + +## Fixed Version +4.1.4 + +## Advisory link + * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38095) + * [Patchstack](https://patchstack.com/database/vulnerability/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-3-cross-site-request-forgery-csrf-vulnerability) diff --git a/content/cve/CVE-2022-38134.md b/content/cve/CVE-2022-38134.md new file mode 100644 index 0000000..8ecccf2 --- /dev/null +++ b/content/cve/CVE-2022-38134.md @@ -0,0 +1,54 @@ +--- +title: "CVE-2022-38134" +date: 2022-09-23T11:30:03+00:00 +# weight: 1 +# aliases: ["/first"] +tags: ["cve"] +author: "Muhammad Daffa" +# author: ["Me", "You"] # multiple authors +showToc: true +TocOpen: true +draft: false +hidemeta: true +comments: false +description: "WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control" +canonicalURL: "https://canonical.url/to/page" +disableHLJS: false # to disable highlightjs +disableShare: false +hideSummary: false +searchHidden: true +ShowReadingTime: false +ShowBreadCrumbs: true +ShowPostNavLinks: true +ShowWordCount: false +ShowRssButtonInSectionTermList: true +UseHugoToc: true +cover: + image: "" # image path/url + alt: "" # alt text + caption: "" # display caption under cover + relative: false # when using page bundles set this to true + hidden: true # only hide on current single page +# editPost: +# URL: "https://github.com//content" +# Text: "Suggest Changes" # edit text +# appendFilePath: true # to append file path to Edit link +--- +## Description +Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. + +## Plugin Name +[Customer Reviews for WooCommerce](https://wordpress.org/plugins/customer-reviews-woocommerce/) + +## Installation Number +50,000+ + +## Affected Version +<= 5.3.5 + +## Fixed Version +5.3.6 + +## Advisory link + * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38134) + * [Patchstack](https://patchstack.com/database/vulnerability/customer-reviews-woocommerce/wordpress-customer-reviews-for-woocommerce-plugin-5-3-5-authenticated-broken-access-control-vulnerability) diff --git a/content/cve/CVE-2022-38470.md b/content/cve/CVE-2022-38470.md new file mode 100644 index 0000000..3363adc --- /dev/null +++ b/content/cve/CVE-2022-38470.md @@ -0,0 +1,54 @@ +--- +title: "CVE-2022-38470" +date: 2022-09-22T11:30:03+00:00 +# weight: 1 +# aliases: ["/first"] +tags: ["cve"] +author: "Muhammad Daffa" +# author: ["Me", "You"] # multiple authors +showToc: true +TocOpen: true +draft: false +hidemeta: true +comments: false +description: "WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery" +canonicalURL: "https://canonical.url/to/page" +disableHLJS: false # to disable highlightjs +disableShare: false +hideSummary: false +searchHidden: true +ShowReadingTime: false +ShowBreadCrumbs: true +ShowPostNavLinks: true +ShowWordCount: false +ShowRssButtonInSectionTermList: true +UseHugoToc: true +cover: + image: "" # image path/url + alt: "" # alt text + caption: "" # display caption under cover + relative: false # when using page bundles set this to true + hidden: true # only hide on current single page +# editPost: +# URL: "https://github.com//content" +# Text: "Suggest Changes" # edit text +# appendFilePath: true # to append file path to Edit link +--- +## Description +Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. + +## Plugin Name +[Customer Reviews for WooCommerce](https://wordpress.org/plugins/customer-reviews-woocommerce/) + +## Installation Number +50,000+ + +## Affected Version +<= 5.3.5 + +## Fixed Version +5.3.6 + +## Advisory link + * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38470) + * [Patchstack](https://patchstack.com/database/vulnerability/customer-reviews-woocommerce/wordpress-customer-reviews-for-woocommerce-plugin-5-3-5-cross-site-request-forgery-csrf-vulnerability) diff --git a/content/cve/CVE-2022-38704.md b/content/cve/CVE-2022-38704.md new file mode 100644 index 0000000..f418d1d --- /dev/null +++ b/content/cve/CVE-2022-38704.md @@ -0,0 +1,54 @@ +--- +title: "CVE-2022-38704" +date: 2022-02-23T11:30:03+00:00 +# weight: 1 +# aliases: ["/first"] +tags: ["cve"] +author: "Muhammad Daffa" +# author: ["Me", "You"] # multiple authors +showToc: true +TocOpen: true +draft: false +hidemeta: true +comments: false +description: "WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery" +canonicalURL: "https://canonical.url/to/page" +disableHLJS: false # to disable highlightjs +disableShare: false +hideSummary: false +searchHidden: true +ShowReadingTime: false +ShowBreadCrumbs: true +ShowPostNavLinks: true +ShowWordCount: false +ShowRssButtonInSectionTermList: true +UseHugoToc: true +cover: + image: "" # image path/url + alt: "" # alt text + caption: "" # display caption under cover + relative: false # when using page bundles set this to true + hidden: true # only hide on current single page +# editPost: +# URL: "https://github.com//content" +# Text: "Suggest Changes" # edit text +# appendFilePath: true # to append file path to Edit link +--- +## Description +Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history. + +## Plugin Name +[SEO Redirection Plugin – 301 Redirect Manager](https://wordpress.org/plugins/seo-redirection) + +## Installation Number +30,000+ + +## Affected Version +<= 8.9 + +## Fixed Version +9.1 + +## Advisory link + * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38704) + * [Patchstack](https://patchstack.com/database/vulnerability/seo-redirection/wordpress-seo-redirection-plugin-8-9-cross-site-request-forgery-csrf-vulnerability) diff --git a/content/cve/CVE-2022-40132.md b/content/cve/CVE-2022-40132.md new file mode 100644 index 0000000..a0a1e8d --- /dev/null +++ b/content/cve/CVE-2022-40132.md @@ -0,0 +1,54 @@ +--- +title: "CVE-2022-40132" +date: 2022-09-23T11:30:03+00:00 +# weight: 1 +# aliases: ["/first"] +tags: ["cve"] +author: "Muhammad Daffa" +# author: ["Me", "You"] # multiple authors +showToc: true +TocOpen: true +draft: false +hidemeta: true +comments: false +description: "WordPress Seriously Simple Podcasting plugin <= 2.16.0 - Cross-Site Request Forgery" +canonicalURL: "https://canonical.url/to/page" +disableHLJS: false # to disable highlightjs +disableShare: false +hideSummary: false +searchHidden: true +ShowReadingTime: false +ShowBreadCrumbs: true +ShowPostNavLinks: true +ShowWordCount: false +ShowRssButtonInSectionTermList: true +UseHugoToc: true +cover: + image: "" # image path/url + alt: "" # alt text + caption: "" # display caption under cover + relative: false # when using page bundles set this to true + hidden: true # only hide on current single page +# editPost: +# URL: "https://github.com//content" +# Text: "Suggest Changes" # edit text +# appendFilePath: true # to append file path to Edit link +--- +## Description +Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change. + +## Plugin Name +[Seriously Simple Podcasting](https://wordpress.org/plugins/seriously-simple-podcasting) + +## Installation Number +30,000+ + +## Affected Version +<= 2.16.0 + +## Fixed Version +2.16.1 + +## Advisory link + * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40132) + * [Patchstack](https://patchstack.com/database/vulnerability/seriously-simple-podcasting/wordpress-seriously-simple-podcasting-plugin-2-16-0-cross-site-request-forgery-csrf-vulnerability) diff --git a/content/cve/CVE-2022-40194.md b/content/cve/CVE-2022-40194.md new file mode 100644 index 0000000..377cc7a --- /dev/null +++ b/content/cve/CVE-2022-40194.md @@ -0,0 +1,54 @@ +--- +title: "CVE-2022-40194" +date: 2022-09-23T11:30:03+00:00 +# weight: 1 +# aliases: ["/first"] +tags: ["cve"] +author: "Muhammad Daffa" +# author: ["Me", "You"] # multiple authors +showToc: true +TocOpen: true +draft: false +hidemeta: true +comments: false +description: "WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure" +canonicalURL: "https://canonical.url/to/page" +disableHLJS: false # to disable highlightjs +disableShare: false +hideSummary: false +searchHidden: true +ShowReadingTime: false +ShowBreadCrumbs: true +ShowPostNavLinks: true +ShowWordCount: false +ShowRssButtonInSectionTermList: true +UseHugoToc: true +cover: + image: "" # image path/url + alt: "" # alt text + caption: "" # display caption under cover + relative: false # when using page bundles set this to true + hidden: true # only hide on current single page +# editPost: +# URL: "https://github.com//content" +# Text: "Suggest Changes" # edit text +# appendFilePath: true # to append file path to Edit link +--- +## Description +Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress + +## Plugin Name +[Customer Reviews for WooCommerce](https://wordpress.org/plugins/customer-reviews-woocommerce/) + +## Installation Number +50,000+ + +## Affected Version +<= 5.3.5 + +## Fixed Version +5.3.6 + +## Advisory link + * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38134) + * [Patchstack](https://patchstack.com/database/vulnerability/customer-reviews-woocommerce/wordpress-customer-reviews-for-woocommerce-plugin-5-3-5-sensitive-information-disclosure-vulnerability/) diff --git a/content/portfolio/_index.md b/content/portfolio/_index.md index 5dd60b6..adffa24 100644 --- a/content/portfolio/_index.md +++ b/content/portfolio/_index.md @@ -1,14 +1,62 @@ --- author: "Muhammad Daffa" -title: "Placeholder Text" +title: "Portfolio" date: "2019-03-09" -description: "Lorem Ipsum Dolor Si Amet" -tags: ["markdown", "text"] -hideMeta: true +# description: "About Muhammad Daffa" +tags: ["profile"] +TocOpen: true +draft: false +hidemeta: true +comments: false searchHidden: true ShowBreadCrumbs: false +ShowRssButtonInSectionTermList: false --- -Test -Test -Test +Here are some of my portfolios on cybersecurity + +## Bug Bounties + +The list below are some of the companies that recognize me as a bug hunter. Here are 5 achievements that I just got +- Hall of Fame at Sekolah Siber +- Hall of Fame at wur.nl +- Thanks list at HackerOne PlanetArt +- Thanks list at Private Program HackerOne +- Certificate Appreciation from GeeksforGeeks + +**[Click here](https://daffa.info/achievements/)** to see the full list +## CVEs + +Here is a list of CVEs that I got, most of them came from vulnerabilities in wordpress. I have a target which is to have **100++ CVEs**. +- [CVE-2022-40194](https://daffa.info/cve/cve-2022-40194/) (WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure) +- [CVE-2022-40132](https://daffa.info/cve/cve-2022-40132/) (WordPress Seriously Simple Podcasting plugin <= 2.16.0 - CSRF) +- [CVE-2022-38704](https://daffa.info/cve/cve-2022-38704/) (WordPress SEO Redirection plugin <= 8.9 - CSRF) +- [CVE-2022-38470](https://daffa.info/cve/cve-2022-38470/) (WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - CSRF) +- [CVE-2022-38095](https://daffa.info/cve/cve-2022-38095/) (WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - CSRF) + +Total CVEs: **19** + +**[Click here](https://daffa.info/cve/)** to see the full list + +## GitHub Projects + +These are my github projects which have lots of stars and forks + +- [AllAboutBugBounty](https://github.com/daffainfo/AllAboutBugBounty) +- [all-about-apikey](https://github.com/daffainfo/all-about-apikey) +- [Key-Checker](https://github.com/daffainfo/Key-Checker) +- [match-replace-burp](https://github.com/daffainfo/match-replace-burp) +- [Git-Secret](https://github.com/daffainfo/Git-Secret) +- [Bug-Bounty-Tools](https://github.com/daffainfo/Bug-Bounty-Tools) + +**[Click here](https://github.com/daffainfo?tab=repositories)** to check some of my repositories +## Certifications + +- eLearnSecurity Junior Penetration Tester (eJPT) +- Certified Secure Computer User (C/SCU) +- Fortinet Network Security Expert Level 1: Certified Associate (NSE 1) +- Fortinet Network Security Expert Level 2: Certified Associate (NSE 2) + +## Misc + +- Top contributor at [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) diff --git a/public/404.html b/public/404.html index 5c27505..5ea10e7 100644 --- a/public/404.html +++ b/public/404.html @@ -1,87 +1,4 @@ - - - - - -404 Page not found | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - -
- -
-
-
404
-
-
-© 2022 Muhammad Daffa - -Powered by +404 Page not found | Muhammad Daffa
404
- - - - - - - - \ No newline at end of file + PaperMod
\ No newline at end of file diff --git a/public/about/index.html b/public/about/index.html new file mode 100644 index 0000000..1f662a0 --- /dev/null +++ b/public/about/index.html @@ -0,0 +1,5 @@ +About | Muhammad Daffa

Muhammad Daffa

Hi! I’m Muhammad Daffa, you can call me Daffa. I started learning about cyber security between 2019 / 2020. I was interested in cybersecurity when my facebook friends posted about how they get money doing an activity called “bug bounty”. From that post, I tried to learn more about cybersecurity, especially penetration testing on website

Don’t ever think I’m a professional penetration tester :D. There are still a lot of things about cyber security that I haven’t learned, such as doing penetration testing on Android, iOS, or even on the network. Right now I’m learning about malware analysis too, thanks to TCM Security <3

Contact

Contact me if you have something to discuss or if you have a great resource about cybersecurity, i’ll be very happy to read about the resource :D

Find my contact at the homepage

\ No newline at end of file diff --git a/public/about/index.xml b/public/about/index.xml new file mode 100644 index 0000000..e5d07f6 --- /dev/null +++ b/public/about/index.xml @@ -0,0 +1,14 @@ + + + + About on Muhammad Daffa + https://daffa.info/about/ + Recent content in About on Muhammad Daffa + + https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E + https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E + + Hugo -- gohugo.io + Sat, 09 Mar 2019 00:00:00 +0000 + + diff --git a/public/about/page/1/index.html b/public/about/page/1/index.html new file mode 100644 index 0000000..f899237 --- /dev/null +++ b/public/about/page/1/index.html @@ -0,0 +1 @@ +https://daffa.info/about/ \ No newline at end of file diff --git a/public/achievements/index.html b/public/achievements/index.html new file mode 100644 index 0000000..7c9dfac --- /dev/null +++ b/public/achievements/index.html @@ -0,0 +1,5 @@ +Portfolio | Muhammad Daffa

Here are some of my achievements when doing bug hunting

Bug Bounties and Hall of Fame

Certificate Appreciation

  • Axioo Class Program
  • GeeksforGeeks
  • Cambridge University
  • Windesheim University
  • Finansialku
  • PixelNinja ID
  • Bitrexgo (Website Inactive)
\ No newline at end of file diff --git a/public/achievements/index.xml b/public/achievements/index.xml new file mode 100644 index 0000000..4932dee --- /dev/null +++ b/public/achievements/index.xml @@ -0,0 +1,14 @@ + + + + Portfolio on Muhammad Daffa + https://daffa.info/achievements/ + Recent content in Portfolio on Muhammad Daffa + + https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E + https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E + + Hugo -- gohugo.io + Sat, 09 Mar 2019 00:00:00 +0000 + + diff --git a/public/achievements/page/1/index.html b/public/achievements/page/1/index.html new file mode 100644 index 0000000..9843a4b --- /dev/null +++ b/public/achievements/page/1/index.html @@ -0,0 +1 @@ +https://daffa.info/achievements/ \ No newline at end of file diff --git a/public/assets/js/search.7ea763d329edcc0b8bdc24b427d892f103a377a17831aa4828cba094a8b0db74.js b/public/assets/js/search.7ea763d329edcc0b8bdc24b427d892f103a377a17831aa4828cba094a8b0db74.js new file mode 100644 index 0000000..5d9148a --- /dev/null +++ b/public/assets/js/search.7ea763d329edcc0b8bdc24b427d892f103a377a17831aa4828cba094a8b0db74.js @@ -0,0 +1,19 @@ +/** + * Fuse.js v6.6.2 - Lightweight fuzzy-search (http://fusejs.io) + * + * Copyright (c) 2022 Kiro Risk (http://kiro.me) + * All Rights Reserved. Apache Software License 2.0 + * + * http://www.apache.org/licenses/LICENSE-2.0 + */ +var e,t;e=this,t=function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function t(t){for(var n=1;ne.length)&&(t=e.length);for(var n=0,r=new Array(t);n0&&void 0!==arguments[0]?arguments[0]:1,t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:3,n=new Map,r=Math.pow(10,t);return{get:function(t){var i=t.match(_).length;if(n.has(i))return n.get(i);var o=1/Math.pow(i,.5*e),a=parseFloat(Math.round(o*r)/r);return n.set(i,a),a},clear:function(){n.clear()}}}var O=function(){function e(){var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},n=t.getFn,i=void 0===n?L.getFn:n,o=t.fieldNormWeight,a=void 0===o?L.fieldNormWeight:o;r(this,e),this.norm=S(a,3),this.getFn=i,this.isCreated=!1,this.setIndexRecords()}return o(e,[{key:"setSources",value:function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[];this.docs=e}},{key:"setIndexRecords",value:function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[];this.records=e}},{key:"setKeys",value:function(){var e=this,t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[];this.keys=t,this._keysMap={},t.forEach((function(t,n){e._keysMap[t.id]=n}))}},{key:"create",value:function(){var e=this;!this.isCreated&&this.docs.length&&(this.isCreated=!0,u(this.docs[0])?this.docs.forEach((function(t,n){e._addString(t,n)})):this.docs.forEach((function(t,n){e._addObject(t,n)})),this.norm.clear())}},{key:"add",value:function(e){var t=this.size();u(e)?this._addString(e,t):this._addObject(e,t)}},{key:"removeAt",value:function(e){this.records.splice(e,1);for(var t=e,n=this.size();t2&&void 0!==arguments[2]?arguments[2]:{},r=n.getFn,i=void 0===r?L.getFn:r,o=n.fieldNormWeight,a=void 0===o?L.fieldNormWeight:o,c=new O({getFn:i,fieldNormWeight:a});return c.setKeys(e.map(k)),c.setSources(t),c.create(),c}function j(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},n=t.errors,r=void 0===n?0:n,i=t.currentLocation,o=void 0===i?0:i,a=t.expectedLocation,c=void 0===a?0:a,s=t.distance,h=void 0===s?L.distance:s,u=t.ignoreLocation,l=void 0===u?L.ignoreLocation:u,d=r/e.length;if(l)return d;var f=Math.abs(c-o);return h?d+f/h:f?1:d}function E(){for(var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[],t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:L.minMatchCharLength,n=[],r=-1,i=-1,o=0,a=e.length;o=t&&n.push([r,i]),r=-1)}return e[o-1]&&o-r>=t&&n.push([r,o-1]),n}var I=32;function F(e){for(var t={},n=0,r=e.length;n1&&void 0!==arguments[1]?arguments[1]:{},o=i.location,a=void 0===o?L.location:o,c=i.threshold,s=void 0===c?L.threshold:c,h=i.distance,u=void 0===h?L.distance:h,l=i.includeMatches,d=void 0===l?L.includeMatches:l,f=i.findAllMatches,v=void 0===f?L.findAllMatches:f,g=i.minMatchCharLength,y=void 0===g?L.minMatchCharLength:g,p=i.isCaseSensitive,m=void 0===p?L.isCaseSensitive:p,b=i.ignoreLocation,k=void 0===b?L.ignoreLocation:b;if(r(this,e),this.options={location:a,threshold:s,distance:u,includeMatches:d,findAllMatches:v,minMatchCharLength:y,isCaseSensitive:m,ignoreLocation:k},this.pattern=m?t:t.toLowerCase(),this.chunks=[],this.pattern.length){var M=function(e,t){n.chunks.push({pattern:e,alphabet:F(e),startIndex:t})},w=this.pattern.length;if(w>I){for(var x=0,_=w%I,S=w-_;x3&&void 0!==arguments[3]?arguments[3]:{},i=r.location,o=void 0===i?L.location:i,a=r.distance,c=void 0===a?L.distance:a,s=r.threshold,h=void 0===s?L.threshold:s,u=r.findAllMatches,l=void 0===u?L.findAllMatches:u,d=r.minMatchCharLength,f=void 0===d?L.minMatchCharLength:d,v=r.includeMatches,g=void 0===v?L.includeMatches:v,y=r.ignoreLocation,m=void 0===y?L.ignoreLocation:y;if(t.length>I)throw new Error(p(I));for(var b,k=t.length,M=e.length,w=Math.max(0,Math.min(o,M)),x=h,_=w,S=f>1||g,O=S?Array(M):[];(b=e.indexOf(t,_))>-1;){var A=j(t,{currentLocation:b,expectedLocation:w,distance:c,ignoreLocation:m});if(x=Math.min(A,x),_=b+k,S)for(var F=0;F=T;R-=1){var U=R-1,B=n[e.charAt(U)];if(S&&(O[U]=+!!B),J[R]=(J[R+1]<<1|1)&B,$&&(J[R]|=(C[R+1]|C[R])<<1|1|C[R+1]),J[R]&W&&(N=j(t,{errors:$,currentLocation:U,expectedLocation:w,distance:c,ignoreLocation:m}))<=x){if(x=N,(_=U)<=w)break;T=Math.max(1,2*w-_)}}if(j(t,{errors:$+1,currentLocation:w,expectedLocation:w,distance:c,ignoreLocation:m})>x)break;C=J}var V={isMatch:_>=0,score:Math.max(.001,N)};if(S){var q=E(O,f);q.length?g&&(V.indices=q):V.isMatch=!1}return V}(e,n,i,{location:a+o,distance:s,threshold:h,findAllMatches:u,minMatchCharLength:l,includeMatches:r,ignoreLocation:d}),m=y.isMatch,b=y.score,k=y.indices;m&&(g=!0),v+=b,m&&k&&(f=[].concat(c(f),c(k)))}));var y={isMatch:g,score:g?v/this.chunks.length:1};return g&&r&&(y.indices=f),y}}]),e}(),N=[];function P(e,t){for(var n=0,r=N.length;n-1&&(n.refIndex=e.idx),t.matches.push(n)}}))}function D(e,t){t.score=e.score}function K(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},r=n.includeMatches,i=void 0===r?L.includeMatches:r,o=n.includeScore,a=void 0===o?L.includeScore:o,c=[];return i&&c.push($),a&&c.push(D),e.map((function(e){var n=e.idx,r={item:t[n],refIndex:n};return c.length&&c.forEach((function(t){t(e,r)})),r}))}var T=function(){function e(n){var i=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},o=arguments.length>2?arguments[2]:void 0;if(r(this,e),this.options=t(t({},L),i),this.options.useExtendedSearch)throw new Error(y);this._keyStore=new b(this.options.keys),this.setCollection(n,o)}return o(e,[{key:"setCollection",value:function(e,t){if(this._docs=e,t&&!(t instanceof O))throw new Error("Incorrect 'index' type");this._myIndex=t||A(this.options.keys,this._docs,{getFn:this.options.getFn,fieldNormWeight:this.options.fieldNormWeight})}},{key:"add",value:function(e){f(e)&&(this._docs.push(e),this._myIndex.add(e))}},{key:"remove",value:function(){for(var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:function(){return!1},t=[],n=0,r=this._docs.length;n1&&void 0!==arguments[1]?arguments[1]:{},n=t.limit,r=void 0===n?-1:n,i=this.options,o=i.includeMatches,a=i.includeScore,c=i.shouldSort,s=i.sortFn,h=i.ignoreFieldNorm,d=u(e)?u(this._docs[0])?this._searchStringList(e):this._searchObjectList(e):this._searchLogical(e);return W(d,{ignoreFieldNorm:h}),c&&d.sort(s),l(r)&&r>-1&&(d=d.slice(0,r)),K(d,this._docs,{includeMatches:o,includeScore:a})}},{key:"_searchStringList",value:function(e){var t=P(e,this.options),n=this._myIndex.records,r=[];return n.forEach((function(e){var n=e.v,i=e.i,o=e.n;if(f(n)){var a=t.searchIn(n),c=a.isMatch,s=a.score,h=a.indices;c&&r.push({item:n,idx:i,matches:[{score:s,value:n,norm:o,indices:h}]})}})),r}},{key:"_searchLogical",value:function(e){throw new Error("Logical search is not available")}},{key:"_searchObjectList",value:function(e){var t=this,n=P(e,this.options),r=this._myIndex,i=r.keys,o=r.records,a=[];return o.forEach((function(e){var r=e.$,o=e.i;if(f(r)){var s=[];i.forEach((function(e,i){s.push.apply(s,c(t._findMatches({key:e,value:r[i],searcher:n})))})),s.length&&a.push({idx:o,item:r,matches:s})}})),a}},{key:"_findMatches",value:function(e){var t=e.key,n=e.value,r=e.searcher;if(!f(n))return[];var i=[];if(h(n))n.forEach((function(e){var n=e.v,o=e.i,a=e.n;if(f(n)){var c=r.searchIn(n),s=c.isMatch,h=c.score,u=c.indices;s&&i.push({score:h,key:t,value:n,idx:o,norm:a,indices:u})}}));else{var o=n.v,a=n.n,c=r.searchIn(o),s=c.isMatch,u=c.score,l=c.indices;s&&i.push({score:u,key:t,value:o,norm:a,indices:l})}return i}}]),e}();return T.version="6.6.2",T.createIndex=A,T.parseIndex=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},n=t.getFn,r=void 0===n?L.getFn:n,i=t.fieldNormWeight,o=void 0===i?L.fieldNormWeight:i,a=e.keys,c=e.records,s=new O({getFn:r,fieldNormWeight:o});return s.setKeys(a),s.setIndexRecords(c),s},T.config=L,T},"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).Fuse=t(); +; +/* + PaperMod v6 + License: MIT https://github.com/adityatelange/hugo-PaperMod/blob/master/LICENSE + Copyright (c) 2020 nanxiaobei and adityatelange + Copyright (c) 2021-2022 adityatelange +*/ + +; +(()=>{var i,r,c,e={distance:1e3,iscasesensitive:!1,keys:["title","permalink","summary","content"],location:0,minmatchcharlength:0,shouldsort:!0,threshold:.4},n=document.getElementById("searchResults"),t=document.getElementById("searchInput"),a=null,s=!1;window.onload=function(){let t=new XMLHttpRequest;t.onreadystatechange=function(){if(t.readyState===4)if(t.status===200){{let n=JSON.parse(t.responseText);if(n){let t={distance:100,threshold:.4,ignoreLocation:!0,keys:["title","permalink","summary","content"]};e&&(t={isCaseSensitive:e.iscasesensitive??!1,includeScore:e.includescore??!1,includeMatches:e.includematches??!1,minMatchCharLength:e.minmatchcharlength??1,shouldSort:e.shouldsort??!0,findAllMatches:e.findallmatches??!1,keys:e.keys??["title","permalink","summary","content"],location:e.location??0,threshold:e.threshold??.4,distance:e.distance??100,ignoreLocation:e.ignorelocation??!0}),i=new Fuse(n,t)}}}else console.log(t.responseText)},t.open("GET","../index.json"),t.send()};function o(e){document.querySelectorAll(".focus").forEach(function(e){e.classList.remove("focus")}),e?(e.focus(),document.activeElement=a=e,e.parentElement.classList.add("focus")):document.activeElement.parentElement.classList.add("focus")}function l(){s=!1,n.innerHTML=t.value="",t.focus()}t.onkeyup=function(){if(i){const e=i.search(this.value.trim());if(e.length!==0){let t="";for(let n in e)t+=`
  • ${e[n].item.title} \xBB
  • `;n.innerHTML=t,s=!0,r=n.firstChild,c=n.lastChild}else s=!1,n.innerHTML=""}},t.addEventListener("search",function(){this.value||l()}),document.onkeydown=function(e){let d=e.key,i=document.activeElement,u=document.getElementById("searchbox").contains(i);if(i===t){let e=document.getElementsByClassName("focus");for(;e.length>0;)e[0].classList.remove("focus")}else a&&(i=a);if(d==="Escape")l();else if(!s||!u)return;else d==="ArrowDown"?(e.preventDefault(),i==t?o(n.firstChild.lastChild):i.parentElement!=c&&o(i.parentElement.nextSibling.lastChild)):d==="ArrowUp"?(e.preventDefault(),i.parentElement==r?o(t):i!=t&&o(i.parentElement.previousSibling.lastChild)):d==="ArrowRight"&&i.click()}})() \ No newline at end of file diff --git a/public/blog/index.html b/public/blog/index.html new file mode 100644 index 0000000..0ed930d --- /dev/null +++ b/public/blog/index.html @@ -0,0 +1,4 @@ +Blog | Muhammad Daffa

    Coming Soon! Still in progress migrating from Medium to this website :)

    \ No newline at end of file diff --git a/public/blog/index.xml b/public/blog/index.xml new file mode 100644 index 0000000..42a1502 --- /dev/null +++ b/public/blog/index.xml @@ -0,0 +1,14 @@ + + + + Blog on Muhammad Daffa + https://daffa.info/blog/ + Recent content in Blog on Muhammad Daffa + + https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E + https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E + + Hugo -- gohugo.io + Sat, 09 Mar 2019 00:00:00 +0000 + + diff --git a/public/blog/page/1/index.html b/public/blog/page/1/index.html new file mode 100644 index 0000000..6813fbf --- /dev/null +++ b/public/blog/page/1/index.html @@ -0,0 +1 @@ +https://daffa.info/blog/ \ No newline at end of file diff --git a/public/categories/index.html b/public/categories/index.html index 64b21c8..8804abd 100644 --- a/public/categories/index.html +++ b/public/categories/index.html @@ -1,92 +1,4 @@ - - - - - -Categories | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - -
    - -
    -
    - -
      -
    -
    -
    -© 2022 Muhammad Daffa - -Powered by +Categories | Muhammad Daffa
      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2021-24519/index.html b/public/cve/cve-2021-24519/index.html index 7c8ffcf..8996adc 100644 --- a/public/cve/cve-2021-24519/index.html +++ b/public/cve/cve-2021-24519/index.html @@ -1,164 +1,5 @@ - - - - - -CVE-2021-24519 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2021-24519 -

      -
      -Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) -
      - -
      -

      Description

      -

      The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the ‘Text Next to Icon’ field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue

      -

      Plugin Name

      -

      VikRentCar

      -

      Installation Number

      -

      1,000+

      -

      Affected Version

      -

      <= 1.1.9

      -

      Fixed Version

      -

      1.1.10

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2021-24519 | Muhammad Daffa +

      CVE-2021-24519

      Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)

      Description

      The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the ‘Text Next to Icon’ field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue

      Plugin Name

      VikRentCar

      Installation Number

      1,000+

      Affected Version

      <= 1.1.9

      Fixed Version

      1.1.10

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2021-24531/index.html b/public/cve/cve-2021-24531/index.html index 1fca26a..a20fd03 100644 --- a/public/cve/cve-2021-24531/index.html +++ b/public/cve/cve-2021-24531/index.html @@ -1,169 +1,6 @@ - - - - - -CVE-2021-24531 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2021-24531 -

      -
      -Charitable - Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS) -
      - -
      -

      Description

      -

      The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.

      -

      Plugin Name

      -

      Charitable

      -

      Installation Number

      -

      10,000+

      -

      Affected Version

      -

      <= 1.6.50

      -

      Fixed Version

      -

      1.6.51

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2021-24531 | Muhammad Daffa +

      CVE-2021-24531

      Charitable - Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)

      Description

      The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.

      Plugin Name

      Charitable

      Installation Number

      10,000+

      Affected Version

      <= 1.6.50

      Fixed Version

      1.6.51

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2021-24561/index.html b/public/cve/cve-2021-24561/index.html index dbd55ff..d16e4c2 100644 --- a/public/cve/cve-2021-24561/index.html +++ b/public/cve/cve-2021-24561/index.html @@ -1,169 +1,6 @@ - - - - - -CVE-2021-24561 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2021-24561 -

      -
      -WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting -
      - -
      -

      Description

      -

      The WP SMS WordPress plugin before 5.4.13 does not sanitise the “wp_group_name” parameter before outputting it back in the “Groups” page, leading to an Authenticated Stored Cross-Site Scripting issue

      -

      Plugin Name

      -

      WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc

      -

      Installation Number

      -

      8,000+

      -

      Affected Version

      -

      <= 5.4.12

      -

      Fixed Version

      -

      5.4.13

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2021-24561 | Muhammad Daffa +

      CVE-2021-24561

      WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting

      Description

      The WP SMS WordPress plugin before 5.4.13 does not sanitise the “wp_group_name” parameter before outputting it back in the “Groups” page, leading to an Authenticated Stored Cross-Site Scripting issue

      Plugin Name

      WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc

      Installation Number

      8,000+

      Affected Version

      <= 5.4.12

      Fixed Version

      5.4.13

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-23983/index.html b/public/cve/cve-2022-23983/index.html index 9e0120a..704be20 100644 --- a/public/cve/cve-2022-23983/index.html +++ b/public/cve/cve-2022-23983/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2022-23983 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-23983 -

      -
      -WP Content Copy Protection & No Right Click < 3.4.5 - Settings Update via CSRF -
      - -
      -

      Description

      -

      Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).

      -

      Plugin Name

      -

      WP Content Copy Protection & No Right Click

      -

      Installation Number

      -

      100,000+

      -

      Affected Version

      -

      <= 3.4.4

      -

      Fixed Version

      -

      3.4.5

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-23983 | Muhammad Daffa +

      CVE-2022-23983

      WP Content Copy Protection & No Right Click < 3.4.5 - Settings Update via CSRF

      Description

      Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).

      Plugin Name

      WP Content Copy Protection & No Right Click

      Installation Number

      100,000+

      Affected Version

      <= 3.4.4

      Fixed Version

      3.4.5

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-23984/index.html b/public/cve/cve-2022-23984/index.html index 982704d..095f631 100644 --- a/public/cve/cve-2022-23984/index.html +++ b/public/cve/cve-2022-23984/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2022-23984 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-23984 -

      -
      -wpDiscuz < 7.3.12 - Sensitive Information Disclosure -
      - -
      -

      Description

      -

      Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).

      -

      Plugin Name

      -

      wpDiscuz

      -

      Installation Number

      -

      90,000+

      -

      Affected Version

      -

      <= 7.3.11

      -

      Fixed Version

      -

      7.3.12

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-23984 | Muhammad Daffa +
      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-25618/index.html b/public/cve/cve-2022-25618/index.html index 7610d00..9e74d08 100644 --- a/public/cve/cve-2022-25618/index.html +++ b/public/cve/cve-2022-25618/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2022-25618 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-25618 -

      -
      -wpDataTables < 2.1.28 - Admin+ Stored Cross-Site Scripting -
      - -
      -

      Description

      -

      Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27

      -

      Plugin Name

      -

      wpDataTables

      -

      Installation Number

      -

      60,000+

      -

      Affected Version

      -

      <= 2.1.27

      -

      Fixed Version

      -

      2.1.28

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-25618 | Muhammad Daffa +

      CVE-2022-25618

      wpDataTables < 2.1.28 - Admin+ Stored Cross-Site Scripting

      Description

      Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27

      Plugin Name

      wpDataTables

      Installation Number

      60,000+

      Affected Version

      <= 2.1.27

      Fixed Version

      2.1.28

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-27844/index.html b/public/cve/cve-2022-27844/index.html index 0b35853..e1e2d4a 100644 --- a/public/cve/cve-2022-27844/index.html +++ b/public/cve/cve-2022-27844/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2022-27844 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-27844 -

      -
      -WPvivid Backup and Migration Plugin < 0.9.71 - Admin+ Arbitrary File Download -
      - -
      -

      Description

      -

      Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70

      -

      Plugin Name

      -

      WPvivid

      -

      Installation Number

      -

      200,000+

      -

      Affected Version

      -

      <= 0.9.70

      -

      Fixed Version

      -

      0.9.71

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-27844 | Muhammad Daffa +

      CVE-2022-27844

      WPvivid Backup and Migration Plugin < 0.9.71 - Admin+ Arbitrary File Download

      Description

      Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70

      Plugin Name

      WPvivid

      Installation Number

      200,000+

      Affected Version

      <= 0.9.70

      Fixed Version

      0.9.71

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-27848/index.html b/public/cve/cve-2022-27848/index.html index 9912897..aee1206 100644 --- a/public/cve/cve-2022-27848/index.html +++ b/public/cve/cve-2022-27848/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2022-27848 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-27848 -

      -
      -Modern Events Calendar Lite < 6.5.2 - Admin+ Stored Cross-Site Scripting -
      - -
      -

      Description

      -

      Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1

      -

      Plugin Name

      -

      Modern Events Calendar Lite

      -

      Installation Number

      -

      100,000+ (Closed)

      -

      Affected Version

      -

      <= 6.5.1

      -

      Fixed Version

      -

      6.5.2

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-27848 | Muhammad Daffa +

      CVE-2022-27848

      Modern Events Calendar Lite < 6.5.2 - Admin+ Stored Cross-Site Scripting

      Description

      Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1

      Plugin Name

      Modern Events Calendar Lite

      Installation Number

      100,000+ (Closed)

      Affected Version

      <= 6.5.1

      Fixed Version

      6.5.2

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-33201/index.html b/public/cve/cve-2022-33201/index.html index 511edeb..6f22aca 100644 --- a/public/cve/cve-2022-33201/index.html +++ b/public/cve/cve-2022-33201/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2022-33201 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-33201 -

      -
      -MailerLite - Signup forms (official) < 1.5.7 - API Key Update via CSRF -
      - -
      -

      Description

      -

      Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.

      -

      Plugin Name

      -

      MailerLite – Signup forms (official)

      -

      Installation Number

      -

      60,000+

      -

      Affected Version

      -

      <= 1.5.6

      -

      Fixed Version

      -

      1.5.7

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-33201 | Muhammad Daffa +

      CVE-2022-33201

      MailerLite - Signup forms (official) < 1.5.7 - API Key Update via CSRF

      Description

      Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.

      Plugin Name

      MailerLite – Signup forms (official)

      Installation Number

      60,000+

      Affected Version

      <= 1.5.6

      Fixed Version

      1.5.7

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-34347/index.html b/public/cve/cve-2022-34347/index.html index 1dff8a1..fc56326 100644 --- a/public/cve/cve-2022-34347/index.html +++ b/public/cve/cve-2022-34347/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2021-24519 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2021-24519 -

      -
      -Download Manager < 3.2.49 - Clear Stats & Cache via CSRF -
      - -
      -

      Description

      -

      Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

      -

      Plugin Name

      -

      Download Manager

      -

      Installation Number

      -

      100,000+

      -

      Affected Version

      -

      <= 3.2.48

      -

      Fixed Version

      -

      3.2.49

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-34347 | Muhammad Daffa +

      CVE-2022-34347

      Download Manager < 3.2.49 - Clear Stats & Cache via CSRF

      Description

      Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

      Plugin Name

      Download Manager

      Installation Number

      100,000+

      Affected Version

      <= 3.2.48

      Fixed Version

      3.2.49

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-36282/index.html b/public/cve/cve-2022-36282/index.html index 2c190a6..c06030d 100644 --- a/public/cve/cve-2022-36282/index.html +++ b/public/cve/cve-2022-36282/index.html @@ -1,165 +1,6 @@ - - - - - -CVE-2022-36282 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-36282 -

      -
      -Search Exclude < 1.2.7 - Author+ Stored Cross-Site Scripting -
      - -
      -

      Description

      -

      Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy’s Search Exclude plugin <= 1.2.6 at WordPress.

      -

      Plugin Name

      -

      Search Exclude

      -

      Installation Number

      -

      60,000+

      -

      Affected Version

      -

      <= 1.2.6

      -

      Fixed Version

      -

      1.2.7

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-36282 | Muhammad Daffa +

      CVE-2022-36282

      Search Exclude < 1.2.7 - Author+ Stored Cross-Site Scripting

      Description

      Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy’s Search Exclude plugin <= 1.2.6 at WordPress.

      Plugin Name

      Search Exclude

      Installation Number

      60,000+

      Affected Version

      <= 1.2.6

      Fixed Version

      1.2.7

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-36340/index.html b/public/cve/cve-2022-36340/index.html new file mode 100644 index 0000000..1729d84 --- /dev/null +++ b/public/cve/cve-2022-36340/index.html @@ -0,0 +1,5 @@ +CVE-2022-36340 | Muhammad Daffa +

      CVE-2022-36340

      WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion

      Description

      Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.

      Plugin Name

      Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin

      Installation Number

      30,000+

      Affected Version

      <= 1.2.49.0

      Fixed Version

      1.2.50.0

      \ No newline at end of file diff --git a/public/cve/cve-2022-36346/index.html b/public/cve/cve-2022-36346/index.html index 5ba5913..18d2a1c 100644 --- a/public/cve/cve-2022-36346/index.html +++ b/public/cve/cve-2022-36346/index.html @@ -1,170 +1,6 @@ - - - - - -CVE-2022-36346 | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -
      - -

      -CVE-2022-36346 -

      -
      -MaxButtons < 9.3 - Arbitrary Settings Update via CSRF -
      - -
      -

      Description

      -

      Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.

      -

      Plugin Name

      -

      MaxButtons

      -

      Installation Number

      -

      100,000+

      -

      Affected Version

      -

      <= 9.2

      -

      Fixed Version

      -

      9.3

      - - -
      - -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVE-2022-36346 | Muhammad Daffa +

      CVE-2022-36346

      MaxButtons < 9.3 - Arbitrary Settings Update via CSRF

      Description

      Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.

      Plugin Name

      MaxButtons

      Installation Number

      100,000+

      Affected Version

      <= 9.2

      Fixed Version

      9.3

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/cve-2022-38095/index.html b/public/cve/cve-2022-38095/index.html new file mode 100644 index 0000000..2b02309 --- /dev/null +++ b/public/cve/cve-2022-38095/index.html @@ -0,0 +1,6 @@ +CVE-2022-38095 | Muhammad Daffa +

      CVE-2022-38095

      WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery

      Description

      Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.

      Plugin Name

      Advanced Dynamic Pricing for WooCommerce

      Installation Number

      20,000+

      Affected Version

      <= 4.1.3

      Fixed Version

      4.1.4

      \ No newline at end of file diff --git a/public/cve/cve-2022-38134/index.html b/public/cve/cve-2022-38134/index.html new file mode 100644 index 0000000..d664657 --- /dev/null +++ b/public/cve/cve-2022-38134/index.html @@ -0,0 +1,6 @@ +CVE-2022-38134 | Muhammad Daffa +

      CVE-2022-38134

      WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control

      Description

      Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

      Plugin Name

      Customer Reviews for WooCommerce

      Installation Number

      50,000+

      Affected Version

      <= 5.3.5

      Fixed Version

      5.3.6

      \ No newline at end of file diff --git a/public/cve/cve-2022-38470/index.html b/public/cve/cve-2022-38470/index.html new file mode 100644 index 0000000..8296429 --- /dev/null +++ b/public/cve/cve-2022-38470/index.html @@ -0,0 +1,6 @@ +CVE-2022-38470 | Muhammad Daffa +

      CVE-2022-38470

      WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery

      Description

      Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

      Plugin Name

      Customer Reviews for WooCommerce

      Installation Number

      50,000+

      Affected Version

      <= 5.3.5

      Fixed Version

      5.3.6

      \ No newline at end of file diff --git a/public/cve/cve-2022-38704/index.html b/public/cve/cve-2022-38704/index.html new file mode 100644 index 0000000..58d06cc --- /dev/null +++ b/public/cve/cve-2022-38704/index.html @@ -0,0 +1,6 @@ +CVE-2022-38704 | Muhammad Daffa +

      CVE-2022-38704

      WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery

      Description

      Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.

      Plugin Name

      SEO Redirection Plugin – 301 Redirect Manager

      Installation Number

      30,000+

      Affected Version

      <= 8.9

      Fixed Version

      9.1

      \ No newline at end of file diff --git a/public/cve/cve-2022-40132/index.html b/public/cve/cve-2022-40132/index.html new file mode 100644 index 0000000..fc4d81e --- /dev/null +++ b/public/cve/cve-2022-40132/index.html @@ -0,0 +1,6 @@ +CVE-2022-40132 | Muhammad Daffa +

      CVE-2022-40132

      WordPress Seriously Simple Podcasting plugin <= 2.16.0 - Cross-Site Request Forgery

      Description

      Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change.

      Plugin Name

      Seriously Simple Podcasting

      Installation Number

      30,000+

      Affected Version

      <= 2.16.0

      Fixed Version

      2.16.1

      \ No newline at end of file diff --git a/public/cve/cve-2022-40194/index.html b/public/cve/cve-2022-40194/index.html new file mode 100644 index 0000000..6db39d7 --- /dev/null +++ b/public/cve/cve-2022-40194/index.html @@ -0,0 +1,6 @@ +CVE-2022-40194 | Muhammad Daffa +

      CVE-2022-40194

      WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure

      Description

      Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress

      Plugin Name

      Customer Reviews for WooCommerce

      Installation Number

      50,000+

      Affected Version

      <= 5.3.5

      Fixed Version

      5.3.6

      \ No newline at end of file diff --git a/public/cve/index.html b/public/cve/index.html index 1992740..945acfc 100644 --- a/public/cve/index.html +++ b/public/cve/index.html @@ -1,196 +1,4 @@ - - - - - -CVEs | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      - -
      -

      2022  9 -

      -
      -

      August  3

      -
      -
      -

      CVE-2022-36282 -

      -
      August 23, 2022 · 1 min · 37 words · Muhammad Daffa
      - -
      -
      -

      CVE-2021-24519 -

      -
      August 22, 2022 · 1 min · 35 words · Muhammad Daffa
      - -
      -
      -

      CVE-2022-36346 -

      -
      August 22, 2022 · 1 min · 34 words · Muhammad Daffa
      - -
      -
      -
      -
      -

      May  1

      -
      -
      -

      CVE-2022-33201 -

      -
      May 8, 2022 · 1 min · 47 words · Muhammad Daffa
      - -
      -
      -
      -
      -

      April  3

      -
      -
      -

      CVE-2022-27848 -

      -
      April 14, 2022 · 1 min · 39 words · Muhammad Daffa
      - -
      -
      -

      CVE-2022-27844 -

      -
      April 11, 2022 · 1 min · 36 words · Muhammad Daffa
      - -
      -
      -

      CVE-2022-25618 -

      -
      April 4, 2022 · 1 min · 33 words · Muhammad Daffa
      - -
      -
      -
      -
      -

      February  2

      -
      -
      -

      CVE-2022-23983 -

      -
      February 21, 2022 · 1 min · 51 words · Muhammad Daffa
      - -
      -
      -

      CVE-2022-23984 -

      -
      February 21, 2022 · 1 min · 30 words · Muhammad Daffa
      - -
      -
      -
      -
      -
      -

      2021  3 -

      -
      -

      July  3

      -
      -
      -

      CVE-2021-24561 -

      -
      July 26, 2021 · Muhammad Daffa
      - -
      -
      -

      CVE-2021-24531 -

      -
      July 21, 2021 · Muhammad Daffa
      - -
      -
      -

      CVE-2021-24519 -

      -
      July 19, 2021 · Muhammad Daffa
      - -
      -
      -
      -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +CVEs | Muhammad Daffa

      2022  16

      September  6

      CVE-2022-36340

      September 23, 2022 · Muhammad Daffa

      CVE-2022-38095

      September 23, 2022 · Muhammad Daffa

      CVE-2022-38134

      September 23, 2022 · Muhammad Daffa

      CVE-2022-40132

      September 23, 2022 · Muhammad Daffa

      CVE-2022-40194

      September 23, 2022 · Muhammad Daffa

      CVE-2022-38470

      September 22, 2022 · Muhammad Daffa

      August  3

      CVE-2022-36282

      August 23, 2022 · Muhammad Daffa

      CVE-2022-34347

      August 22, 2022 · Muhammad Daffa

      CVE-2022-36346

      August 22, 2022 · Muhammad Daffa

      May  1

      CVE-2022-33201

      May 8, 2022 · Muhammad Daffa

      April  3

      CVE-2022-27848

      April 14, 2022 · Muhammad Daffa

      CVE-2022-27844

      April 11, 2022 · Muhammad Daffa

      CVE-2022-25618

      April 4, 2022 · Muhammad Daffa

      February  3

      CVE-2022-38704

      February 23, 2022 · Muhammad Daffa

      CVE-2022-23983

      February 21, 2022 · Muhammad Daffa

      CVE-2022-23984

      February 21, 2022 · Muhammad Daffa

      2021  3

      July  3

      CVE-2021-24561

      July 26, 2021 · Muhammad Daffa

      CVE-2021-24531

      July 21, 2021 · Muhammad Daffa

      CVE-2021-24519

      July 19, 2021 · Muhammad Daffa
      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/cve/index.xml b/public/cve/index.xml index 87c23d0..833a56f 100644 --- a/public/cve/index.xml +++ b/public/cve/index.xml @@ -9,7 +9,61 @@ https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- gohugo.io - Tue, 23 Aug 2022 11:30:03 +0000 + Fri, 23 Sep 2022 11:30:03 +0000 + + CVE-2022-36340 + https://daffa.info/cve/cve-2022-36340/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-36340/ + WordPress MailOptin plugin &lt;= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion + + + + CVE-2022-38095 + https://daffa.info/cve/cve-2022-38095/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38095/ + WordPress Advanced Dynamic Pricing for WooCommerce plugin &lt;= 4.1.3 - Cross-Site Request Forgery + + + + CVE-2022-38134 + https://daffa.info/cve/cve-2022-38134/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38134/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Authenticated Broken Access Control + + + + CVE-2022-40132 + https://daffa.info/cve/cve-2022-40132/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-40132/ + WordPress Seriously Simple Podcasting plugin &lt;= 2.16.0 - Cross-Site Request Forgery + + + + CVE-2022-40194 + https://daffa.info/cve/cve-2022-40194/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-40194/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Sensitive Information Disclosure + + + + CVE-2022-38470 + https://daffa.info/cve/cve-2022-38470/ + Thu, 22 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38470/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Cross-Site Request Forgery + + CVE-2022-36282 https://daffa.info/cve/cve-2022-36282/ @@ -20,7 +74,7 @@ - CVE-2021-24519 + CVE-2022-34347 https://daffa.info/cve/cve-2022-34347/ Mon, 22 Aug 2022 11:30:03 +0000 @@ -73,6 +127,15 @@ wpDataTables &lt; 2.1.28 - Admin+ Stored Cross-Site Scripting + + CVE-2022-38704 + https://daffa.info/cve/cve-2022-38704/ + Wed, 23 Feb 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38704/ + WordPress SEO Redirection plugin &lt;= 8.9 - Cross-Site Request Forgery + + CVE-2022-23983 https://daffa.info/cve/cve-2022-23983/ diff --git a/public/index.html b/public/index.html index 6c88046..a663b97 100644 --- a/public/index.html +++ b/public/index.html @@ -1,114 +1,4 @@ - - - - - - -Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      -
      -Muhammad Daffa -

      Muhammad Daffa

      -Vulnerability Researcher at spiderSilk - -
      -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +Muhammad Daffa
      Muhammad Daffa

      Muhammad Daffa

      Vulnerability Researcher at spiderSilk
      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/index.json b/public/index.json index 25d8038..0637a08 100644 --- a/public/index.json +++ b/public/index.json @@ -1 +1 @@ -[{"content":"Description The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the \u0026lsquo;Text Next to Icon\u0026rsquo; field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue\nPlugin Name VikRentCar\nInstallation Number 1,000+\nAffected Version \u0026lt;= 1.1.9\nFixed Version 1.1.10\nAdvisory Link MITRE WPScan ","permalink":"https://daffa.info/cve/cve-2021-24519/","summary":"Description The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the \u0026lsquo;Text Next to Icon\u0026rsquo; field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue\nPlugin Name VikRentCar\nInstallation Number 1,000+\nAffected Version \u0026lt;= 1.1.9\nFixed Version 1.1.10\nAdvisory Link MITRE WPScan ","title":"CVE-2021-24519"}] \ No newline at end of file +[] \ No newline at end of file diff --git a/public/index.xml b/public/index.xml index 93eb606..9b19c20 100644 --- a/public/index.xml +++ b/public/index.xml @@ -9,7 +9,61 @@ https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- gohugo.io - Tue, 23 Aug 2022 11:30:03 +0000 + Fri, 23 Sep 2022 11:30:03 +0000 + + CVE-2022-36340 + https://daffa.info/cve/cve-2022-36340/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-36340/ + WordPress MailOptin plugin &lt;= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion + + + + CVE-2022-38095 + https://daffa.info/cve/cve-2022-38095/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38095/ + WordPress Advanced Dynamic Pricing for WooCommerce plugin &lt;= 4.1.3 - Cross-Site Request Forgery + + + + CVE-2022-38134 + https://daffa.info/cve/cve-2022-38134/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38134/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Authenticated Broken Access Control + + + + CVE-2022-40132 + https://daffa.info/cve/cve-2022-40132/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-40132/ + WordPress Seriously Simple Podcasting plugin &lt;= 2.16.0 - Cross-Site Request Forgery + + + + CVE-2022-40194 + https://daffa.info/cve/cve-2022-40194/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-40194/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Sensitive Information Disclosure + + + + CVE-2022-38470 + https://daffa.info/cve/cve-2022-38470/ + Thu, 22 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38470/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Cross-Site Request Forgery + + CVE-2022-36282 https://daffa.info/cve/cve-2022-36282/ @@ -20,7 +74,7 @@ - CVE-2021-24519 + CVE-2022-34347 https://daffa.info/cve/cve-2022-34347/ Mon, 22 Aug 2022 11:30:03 +0000 @@ -73,6 +127,15 @@ wpDataTables &lt; 2.1.28 - Admin+ Stored Cross-Site Scripting + + CVE-2022-38704 + https://daffa.info/cve/cve-2022-38704/ + Wed, 23 Feb 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38704/ + WordPress SEO Redirection plugin &lt;= 8.9 - Cross-Site Request Forgery + + CVE-2022-23983 https://daffa.info/cve/cve-2022-23983/ diff --git a/public/portfolio/index.html b/public/portfolio/index.html index 1180188..fce1548 100644 --- a/public/portfolio/index.html +++ b/public/portfolio/index.html @@ -1,102 +1,7 @@ - - - - - -Placeholder Text | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      - -

      Test -Test -Test

      -
      -
      -
      -© 2022 Muhammad Daffa - -Powered by +Portfolio | Muhammad Daffa

      Here are some of my portfolios on cybersecurity

      Bug Bounties

      The list below are some of the companies that recognize me as a bug hunter. Here are 5 achievements that I just got

      • Hall of Fame at Sekolah Siber
      • Hall of Fame at wur.nl
      • Thanks list at HackerOne PlanetArt
      • Thanks list at Private Program HackerOne
      • Certificate Appreciation from GeeksforGeeks

      Click here to see the full list

      CVEs

      Here is a list of CVEs that I got, most of them came from vulnerabilities in wordpress. I have a target which is to have 100++ CVEs.

      • CVE-2022-40194 (WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure)
      • CVE-2022-40132 (WordPress Seriously Simple Podcasting plugin <= 2.16.0 - CSRF)
      • CVE-2022-38704 (WordPress SEO Redirection plugin <= 8.9 - CSRF)
      • CVE-2022-38470 (WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - CSRF)
      • CVE-2022-38095 (WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - CSRF)

      Total CVEs: 19

      Click here to see the full list

      GitHub Projects

      These are my github projects which have lots of stars and forks

      Click here to check some of my repositories

      Certifications

      • eLearnSecurity Junior Penetration Tester (eJPT)
      • Certified Secure Computer User (C/SCU)
      • Fortinet Network Security Expert Level 1: Certified Associate (NSE 1)
      • Fortinet Network Security Expert Level 2: Certified Associate (NSE 2)

      Misc

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/portfolio/index.xml b/public/portfolio/index.xml index 2ae6387..af98c9e 100644 --- a/public/portfolio/index.xml +++ b/public/portfolio/index.xml @@ -1,9 +1,9 @@ - Placeholder Text on Muhammad Daffa + Portfolio on Muhammad Daffa https://daffa.info/portfolio/ - Recent content in Placeholder Text on Muhammad Daffa + Recent content in Portfolio on Muhammad Daffa https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E diff --git a/public/portfolio/page/1/index.html b/public/portfolio/page/1/index.html index 5b52d27..e316827 100644 --- a/public/portfolio/page/1/index.html +++ b/public/portfolio/page/1/index.html @@ -1 +1 @@ -https://daffa.info/portfolio/ \ No newline at end of file +https://daffa.info/portfolio/ \ No newline at end of file diff --git a/public/search/index.html b/public/search/index.html index 7f03ef8..cb8b085 100644 --- a/public/search/index.html +++ b/public/search/index.html @@ -1,99 +1,5 @@ - - - - - -Search | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      - - -
      -
      -© 2022 Muhammad Daffa - -Powered by +Search | Muhammad Daffa +
      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/sitemap.xml b/public/sitemap.xml index 05ac650..24183be 100644 --- a/public/sitemap.xml +++ b/public/sitemap.xml @@ -3,18 +3,36 @@ xmlns:xhtml="http://www.w3.org/1999/xhtml"> https://daffa.info/tags/cve/ - 2022-08-23T11:30:03+00:00 + 2022-09-23T11:30:03+00:00 - https://daffa.info/cve/cve-2022-36282/ - 2022-08-23T11:30:03+00:00 + https://daffa.info/cve/cve-2022-36340/ + 2022-09-23T11:30:03+00:00 + + https://daffa.info/cve/cve-2022-38095/ + 2022-09-23T11:30:03+00:00 + + https://daffa.info/cve/cve-2022-38134/ + 2022-09-23T11:30:03+00:00 + + https://daffa.info/cve/cve-2022-40132/ + 2022-09-23T11:30:03+00:00 + + https://daffa.info/cve/cve-2022-40194/ + 2022-09-23T11:30:03+00:00 https://daffa.info/cve/ - 2022-08-23T11:30:03+00:00 + 2022-09-23T11:30:03+00:00 https://daffa.info/ - 2022-08-23T11:30:03+00:00 + 2022-09-23T11:30:03+00:00 https://daffa.info/tags/ + 2022-09-23T11:30:03+00:00 + + https://daffa.info/cve/cve-2022-38470/ + 2022-09-22T11:30:03+00:00 + + https://daffa.info/cve/cve-2022-36282/ 2022-08-23T11:30:03+00:00 https://daffa.info/cve/cve-2022-34347/ @@ -34,6 +52,9 @@ https://daffa.info/cve/cve-2022-25618/ 2022-04-04T11:30:03+00:00 + + https://daffa.info/cve/cve-2022-38704/ + 2022-02-23T11:30:03+00:00 https://daffa.info/cve/cve-2022-23983/ 2022-02-21T11:30:03+00:00 @@ -50,13 +71,19 @@ https://daffa.info/cve/cve-2021-24519/ 2021-07-19T11:30:03+00:00 - https://daffa.info/tags/markdown/ + https://daffa.info/about/ + 2019-03-09T00:00:00+00:00 + + https://daffa.info/blog/ + 2019-03-09T00:00:00+00:00 + + https://daffa.info/achievements/ 2019-03-09T00:00:00+00:00 https://daffa.info/portfolio/ 2019-03-09T00:00:00+00:00 - https://daffa.info/tags/text/ + https://daffa.info/tags/profile/ 2019-03-09T00:00:00+00:00 https://daffa.info/categories/ diff --git a/public/tags/cve/index.html b/public/tags/cve/index.html index 60fca87..cc2f22a 100644 --- a/public/tags/cve/index.html +++ b/public/tags/cve/index.html @@ -1,180 +1,30 @@ - - - - - -cve | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      - -
      -
      -

      CVE-2022-36282 -

      -
      -
      -

      Description Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy’s Search Exclude plugin <= 1.2.6 at WordPress. -Plugin Name Search Exclude -Installation Number 60,000+ -Affected Version <= 1.2.6 -Fixed Version 1.2.7 -Advisory Link MITRE WPScan Patchstack

      -
      -
      August 23, 2022 · 1 min · 37 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2021-24519 -

      -
      -
      -

      Description Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. -Plugin Name Download Manager -Installation Number 100,000+ -Affected Version <= 3.2.48 -Fixed Version 3.2.49 -Advisory Link MITRE WPScan Patchstack

      -
      -
      August 22, 2022 · 1 min · 35 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2022-36346 -

      -
      -
      -

      Description Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. -Plugin Name MaxButtons -Installation Number 100,000+ -Affected Version <= 9.2 -Fixed Version 9.3 -Advisory Link MITRE WPScan Patchstack

      -
      -
      August 22, 2022 · 1 min · 34 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2022-33201 -

      -
      -
      -

      Description Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key. -Plugin Name MailerLite – Signup forms (official) -Installation Number 60,000+ -Affected Version <= 1.5.6 -Fixed Version 1.5.7 -Advisory link MITRE WPScan Patchstack

      -
      -
      May 8, 2022 · 1 min · 47 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2022-27848 -

      -
      -
      -

      Description Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1 -Plugin Name Modern Events Calendar Lite -Installation Number 100,000+ (Closed) -Affected Version <= 6.5.1 -Fixed Version 6.5.2 -Advisory link MITRE WPScan Patchstack

      -
      -
      April 14, 2022 · 1 min · 39 words · Muhammad Daffa
      - -
      - -
      -
      -© 2022 Muhammad Daffa - -Powered by +cve | Muhammad Daffa

      CVE-2022-36340

      Description Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress. +Plugin Name Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin +Installation Number 30,000+ +Affected Version <= 1.2.49.0 +Fixed Version 1.2.50.0 +Advisory link MITRE Patchstack

      CVE-2022-38095

      Description Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress. +Plugin Name Advanced Dynamic Pricing for WooCommerce +Installation Number 20,000+ +Affected Version <= 4.1.3 +Fixed Version 4.1.4 +Advisory link MITRE Patchstack

      CVE-2022-38134

      Description Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. +Plugin Name Customer Reviews for WooCommerce +Installation Number 50,000+ +Affected Version <= 5.3.5 +Fixed Version 5.3.6 +Advisory link MITRE Patchstack

      CVE-2022-40132

      Description Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change. +Plugin Name Seriously Simple Podcasting +Installation Number 30,000+ +Affected Version <= 2.16.0 +Fixed Version 2.16.1 +Advisory link MITRE Patchstack

      CVE-2022-40194

      Description Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress +Plugin Name Customer Reviews for WooCommerce +Installation Number 50,000+ +Affected Version <= 5.3.5 +Fixed Version 5.3.6 +Advisory link MITRE Patchstack

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/tags/cve/index.xml b/public/tags/cve/index.xml index 650db0b..0a07248 100644 --- a/public/tags/cve/index.xml +++ b/public/tags/cve/index.xml @@ -9,7 +9,61 @@ https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- gohugo.io - Tue, 23 Aug 2022 11:30:03 +0000 + Fri, 23 Sep 2022 11:30:03 +0000 + + CVE-2022-36340 + https://daffa.info/cve/cve-2022-36340/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-36340/ + WordPress MailOptin plugin &lt;= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion + + + + CVE-2022-38095 + https://daffa.info/cve/cve-2022-38095/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38095/ + WordPress Advanced Dynamic Pricing for WooCommerce plugin &lt;= 4.1.3 - Cross-Site Request Forgery + + + + CVE-2022-38134 + https://daffa.info/cve/cve-2022-38134/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38134/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Authenticated Broken Access Control + + + + CVE-2022-40132 + https://daffa.info/cve/cve-2022-40132/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-40132/ + WordPress Seriously Simple Podcasting plugin &lt;= 2.16.0 - Cross-Site Request Forgery + + + + CVE-2022-40194 + https://daffa.info/cve/cve-2022-40194/ + Fri, 23 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-40194/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Sensitive Information Disclosure + + + + CVE-2022-38470 + https://daffa.info/cve/cve-2022-38470/ + Thu, 22 Sep 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38470/ + WordPress Customer Reviews for WooCommerce plugin &lt;= 5.3.5 - Cross-Site Request Forgery + + CVE-2022-36282 https://daffa.info/cve/cve-2022-36282/ @@ -20,7 +74,7 @@ - CVE-2021-24519 + CVE-2022-34347 https://daffa.info/cve/cve-2022-34347/ Mon, 22 Aug 2022 11:30:03 +0000 @@ -73,6 +127,15 @@ wpDataTables &lt; 2.1.28 - Admin+ Stored Cross-Site Scripting + + CVE-2022-38704 + https://daffa.info/cve/cve-2022-38704/ + Wed, 23 Feb 2022 11:30:03 +0000 + + https://daffa.info/cve/cve-2022-38704/ + WordPress SEO Redirection plugin &lt;= 8.9 - Cross-Site Request Forgery + + CVE-2022-23983 https://daffa.info/cve/cve-2022-23983/ diff --git a/public/tags/cve/page/1/index.html b/public/tags/cve/page/1/index.html index b3e96d5..50c43ed 100644 --- a/public/tags/cve/page/1/index.html +++ b/public/tags/cve/page/1/index.html @@ -1 +1 @@ -https://daffa.info/tags/cve/ \ No newline at end of file +https://daffa.info/tags/cve/ \ No newline at end of file diff --git a/public/tags/cve/page/2/index.html b/public/tags/cve/page/2/index.html index a730d1b..43e454c 100644 --- a/public/tags/cve/page/2/index.html +++ b/public/tags/cve/page/2/index.html @@ -1,183 +1,31 @@ - - - - - -cve | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      - -
      -
      -

      CVE-2022-27844 -

      -
      -
      -

      Description Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70 -Plugin Name WPvivid -Installation Number 200,000+ -Affected Version <= 0.9.70 -Fixed Version 0.9.71 -Advisory link MITRE WPScan Patchstack

      -
      -
      April 11, 2022 · 1 min · 36 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2022-25618 -

      -
      -
      -

      Description Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27 -Plugin Name wpDataTables +cve | Muhammad Daffa

      CVE-2022-38470

      Description Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. +Plugin Name Customer Reviews for WooCommerce +Installation Number 50,000+ +Affected Version <= 5.3.5 +Fixed Version 5.3.6 +Advisory link MITRE Patchstack

      CVE-2022-36282

      Description Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy’s Search Exclude plugin <= 1.2.6 at WordPress. +Plugin Name Search Exclude Installation Number 60,000+ -Affected Version <= 2.1.27 -Fixed Version 2.1.28 -Advisory link MITRE WPScan Patchstack

      -
      -
      April 4, 2022 · 1 min · 33 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2022-23983 -

      -
      -
      -

      Description Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4). -Plugin Name WP Content Copy Protection & No Right Click +Affected Version <= 1.2.6 +Fixed Version 1.2.7 +Advisory Link MITRE WPScan Patchstack

      August 23, 2022 · Muhammad Daffa

      CVE-2022-34347

      Description Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. +Plugin Name Download Manager Installation Number 100,000+ -Affected Version <= 3.4.4 -Fixed Version 3.4.5 -Advisory link MITRE WPScan Patchstack

      -
      -
      February 21, 2022 · 1 min · 51 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2022-23984 -

      -
      -
      -

      Description Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). -Plugin Name wpDiscuz -Installation Number 90,000+ -Affected Version <= 7.3.11 -Fixed Version 7.3.12 -Advisory link MITRE WPScan Patchstack

      -
      -
      February 21, 2022 · 1 min · 30 words · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2021-24561 -

      -
      -
      -

      Description The WP SMS WordPress plugin before 5.4.13 does not sanitise the “wp_group_name” parameter before outputting it back in the “Groups” page, leading to an Authenticated Stored Cross-Site Scripting issue -Plugin Name WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc -Installation Number 8,000+ -Affected Version <= 5.4.12 -Fixed Version 5.4.13 -Advisory link MITRE WPScan

      -
      -
      July 26, 2021 · Muhammad Daffa
      - -
      - -
      -
      -© 2022 Muhammad Daffa - -Powered by +Affected Version <= 3.2.48 +Fixed Version 3.2.49 +Advisory Link MITRE WPScan Patchstack

      August 22, 2022 · Muhammad Daffa

      CVE-2022-36346

      Description Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. +Plugin Name MaxButtons +Installation Number 100,000+ +Affected Version <= 9.2 +Fixed Version 9.3 +Advisory Link MITRE WPScan Patchstack

      August 22, 2022 · Muhammad Daffa

      CVE-2022-33201

      Description Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key. +Plugin Name MailerLite – Signup forms (official) +Installation Number 60,000+ +Affected Version <= 1.5.6 +Fixed Version 1.5.7 +Advisory link MITRE WPScan Patchstack

      May 8, 2022 · Muhammad Daffa
      - - - - - - - - \ No newline at end of file + PaperMod \ No newline at end of file diff --git a/public/tags/cve/page/3/index.html b/public/tags/cve/page/3/index.html index 8631394..fdae6fb 100644 --- a/public/tags/cve/page/3/index.html +++ b/public/tags/cve/page/3/index.html @@ -1,133 +1,31 @@ - - - - - -cve | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      - -
      -
      -

      CVE-2021-24531 -

      -
      -
      -

      Description The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature. -Plugin Name Charitable -Installation Number 10,000+ -Affected Version <= 1.6.50 -Fixed Version 1.6.51 -Advisory Link MITRE WPScan

      -
      -
      July 21, 2021 · Muhammad Daffa
      - -
      -
      -
      -

      CVE-2021-24519 -

      -
      -
      -

      Description The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the ‘Text Next to Icon’ field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue -Plugin Name VikRentCar -Installation Number 1,000+ -Affected Version <= 1.1.9 -Fixed Version 1.1.10 -Advisory Link MITRE WPScan

      -
      -
      July 19, 2021 · Muhammad Daffa
      - -
      - -
      -
      -© 2022 Muhammad Daffa - -Powered by +cve | Muhammad Daffa

      CVE-2022-27848

      Description Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1 +Plugin Name Modern Events Calendar Lite +Installation Number 100,000+ (Closed) +Affected Version <= 6.5.1 +Fixed Version 6.5.2 +Advisory link MITRE WPScan Patchstack

      April 14, 2022 · Muhammad Daffa

      CVE-2022-27844

      Description Arbitrary File Read vulnerability in WPvivid Team Migration, Backup, Staging – WPvivid (WordPress plugin) versions <= 0.9.70 +Plugin Name WPvivid +Installation Number 200,000+ +Affected Version <= 0.9.70 +Fixed Version 0.9.71 +Advisory link MITRE WPScan Patchstack

      April 11, 2022 · Muhammad Daffa

      CVE-2022-25618

      Description Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27 +Plugin Name wpDataTables +Installation Number 60,000+ +Affected Version <= 2.1.27 +Fixed Version 2.1.28 +Advisory link MITRE WPScan Patchstack

      April 4, 2022 · Muhammad Daffa

      CVE-2022-38704

      Description Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history. +Plugin Name SEO Redirection Plugin – 301 Redirect Manager +Installation Number 30,000+ +Affected Version <= 8.9 +Fixed Version 9.1 +Advisory link MITRE Patchstack

      CVE-2022-23983

      Description Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4). +Plugin Name WP Content Copy Protection & No Right Click +Installation Number 100,000+ +Affected Version <= 3.4.4 +Fixed Version 3.4.5 +Advisory link MITRE WPScan Patchstack

      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/tags/cve/page/4/index.html b/public/tags/cve/page/4/index.html new file mode 100644 index 0000000..35b0cdd --- /dev/null +++ b/public/tags/cve/page/4/index.html @@ -0,0 +1,25 @@ +cve | Muhammad Daffa

      CVE-2022-23984

      Description Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). +Plugin Name wpDiscuz +Installation Number 90,000+ +Affected Version <= 7.3.11 +Fixed Version 7.3.12 +Advisory link MITRE WPScan Patchstack

      February 21, 2022 · Muhammad Daffa

      CVE-2021-24561

      Description The WP SMS WordPress plugin before 5.4.13 does not sanitise the “wp_group_name” parameter before outputting it back in the “Groups” page, leading to an Authenticated Stored Cross-Site Scripting issue +Plugin Name WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc +Installation Number 8,000+ +Affected Version <= 5.4.12 +Fixed Version 5.4.13 +Advisory link MITRE WPScan

      July 26, 2021 · Muhammad Daffa

      CVE-2021-24531

      Description The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature. +Plugin Name Charitable +Installation Number 10,000+ +Affected Version <= 1.6.50 +Fixed Version 1.6.51 +Advisory Link MITRE WPScan

      July 21, 2021 · Muhammad Daffa

      CVE-2021-24519

      Description The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the ‘Text Next to Icon’ field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue +Plugin Name VikRentCar +Installation Number 1,000+ +Affected Version <= 1.1.9 +Fixed Version 1.1.10 +Advisory Link MITRE WPScan

      July 19, 2021 · Muhammad Daffa
      \ No newline at end of file diff --git a/public/tags/index.html b/public/tags/index.html index 91ba810..1645d38 100644 --- a/public/tags/index.html +++ b/public/tags/index.html @@ -1,101 +1,4 @@ - - - - - -Tags | Muhammad Daffa - - - - - - - - - - - - - - - - - - - - - - - - -
      - -
      -
      - - -
      -
      -© 2022 Muhammad Daffa - -Powered by +Tags | Muhammad Daffa
      - - - - - - - - \ No newline at end of file + PaperMod
      \ No newline at end of file diff --git a/public/tags/index.xml b/public/tags/index.xml index 0902fc6..05f6504 100644 --- a/public/tags/index.xml +++ b/public/tags/index.xml @@ -9,31 +9,22 @@ https://daffa.info/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- gohugo.io - Tue, 23 Aug 2022 11:30:03 +0000 + Fri, 23 Sep 2022 11:30:03 +0000 cve https://daffa.info/tags/cve/ - Tue, 23 Aug 2022 11:30:03 +0000 + Fri, 23 Sep 2022 11:30:03 +0000 https://daffa.info/tags/cve/ - markdown - https://daffa.info/tags/markdown/ + profile + https://daffa.info/tags/profile/ Sat, 09 Mar 2019 00:00:00 +0000 - https://daffa.info/tags/markdown/ - - - - - text - https://daffa.info/tags/text/ - Sat, 09 Mar 2019 00:00:00 +0000 - - https://daffa.info/tags/text/ + https://daffa.info/tags/profile/ diff --git a/public/tags/markdown/index.html b/public/tags/markdown/index.html index 4d6d995..aef09a1 100644 --- a/public/tags/markdown/index.html +++ b/public/tags/markdown/index.html @@ -45,7 +45,7 @@