CVSS: 3.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35232 – github.com/huandu/facebook may expose access_token in error message
https://notcve.org/view.php?id=CVE-2024-35232
24 May 2024 — github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2. github.com/huandu/facebook es un paquete Go que es totalmente compatible con la API Graph de Facebook con carga de archivos, solicitud por lotes y API de marketing. access_token puede exponerse en un mensaje de error si falla la solicitud HTTP. Este problema ... • https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.1EPSS: 6%CPEs: 1EXPL: 2CVE-2021-24217 – Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain
https://notcve.org/view.php?id=CVE-2021-24217
25 Mar 2021 — The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution. La función run_action del plugin de Facebook para WordPress versiones anteriores a 3.0.0, deserializa unos datos suministrados por el usuario, haciendo posible que sean suministrados objetos PHP creando una ... • https://wpscan.com/vulnerability/509f2754-a1a1-4142-9126-ae023a88533a • CWE-502: Deserialization of Untrusted Data •