From d5e97c14b18439a1268d8a7045bcde9d3c6349f2 Mon Sep 17 00:00:00 2001 From: sullo Date: Mon, 17 Apr 2023 09:23:19 -0400 Subject: [PATCH] Cleanups and syntax --- cves/2014/CVE-2014-6287.yaml | 4 ++-- cves/2022/CVE-2022-2462.yaml | 3 +-- cves/2023/CVE-2023-0968.yaml | 2 +- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/cves/2014/CVE-2014-6287.yaml b/cves/2014/CVE-2014-6287.yaml index 2cadd90d1c..8d157eba81 100644 --- a/cves/2014/CVE-2014-6287.yaml +++ b/cves/2014/CVE-2014-6287.yaml @@ -29,8 +29,8 @@ variables: requests: - method: GET path: - - '{{BaseURL}}/?search==%00{.exec|cmd.exe+/c+ping+127.0.0.1+-n+10.}' - #- '{{BaseURL}}/?search==%00{.cookie|{{str1}}|value%3d{{str2}}.}' + - '{{BaseURL}}/?search==%00{.exec|cmd.exe+/c+ping+127.0.0.1+-n+10.}' + # - '{{BaseURL}}/?search==%00{.cookie|{{str1}}|value%3d{{str2}}.}' matchers-condition: and matchers: diff --git a/cves/2022/CVE-2022-2462.yaml b/cves/2022/CVE-2022-2462.yaml index f0f914b372..2c9c797882 100644 --- a/cves/2022/CVE-2022-2462.yaml +++ b/cves/2022/CVE-2022-2462.yaml @@ -5,8 +5,7 @@ info: author: dwisiswant0 severity: medium description: | - WordPress Transposh plugin through is susceptible to information disclosure via the AJAX action -tp_history, which is intended to return data about who has translated a text given by the token parameter. However, the plugin also returns the user's login name as part of the user_login attribute. If an anonymous user submits the translation, the user's IP address is returned. An attacker can leak the WordPress username of translators and potentially execute other unauthorized operations. + WordPress Transposh plugin through is susceptible to information disclosure via the AJAX action tp_history, which is intended to return data about who has translated a text given by the token parameter. However, the plugin also returns the user's login name as part of the user_login attribute. If an anonymous user submits the translation, the user's IP address is returned. An attacker can leak the WordPress username of translators and potentially execute other unauthorized operations. reference: - https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt - https://github.com/oferwald/transposh diff --git a/cves/2023/CVE-2023-0968.yaml b/cves/2023/CVE-2023-0968.yaml index 8d4cbef076..5d66d0fd7b 100644 --- a/cves/2023/CVE-2023-0968.yaml +++ b/cves/2023/CVE-2023-0968.yaml @@ -5,7 +5,7 @@ info: author: r3Y3r53 severity: medium description: | - WordPress Watu Quiz plugin before 3.3.9.1 is susceptible to cross-site scripting. The plugin does not sanitize and escape some parameters, such as email, dn, date, and points, before outputting then back in a page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This exploit can be used against high-privilege users such as admin. + WordPress Watu Quiz plugin before 3.3.9.1 is susceptible to cross-site scripting. The plugin does not sanitize and escape some parameters, such as email, dn, date, and points, before outputting then back in a page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This exploit can be used against high-privilege users such as admin. reference: - https://wpscan.com/vulnerability/29008d1a-62b3-4f40-b5a3-134455b01595 - https://wordpress.org/plugins/watu/