CVSS: 3.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35232 – github.com/huandu/facebook may expose access_token in error message
https://notcve.org/view.php?id=CVE-2024-35232
github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2. github.com/huandu/facebook es un paquete Go que es totalmente compatible con la API Graph de Facebook con carga de archivos, solicitud por lotes y API de marketing. access_token puede exponerse en un mensaje de error si falla la solicitud HTTP. Este problema se solucionó en la versión 2.7.2. • https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30 https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567 https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4 https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24217 – Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain
https://notcve.org/view.php?id=CVE-2021-24217
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution. La función run_action del plugin de Facebook para WordPress versiones anteriores a 3.0.0, deserializa unos datos suministrados por el usuario, haciendo posible que sean suministrados objetos PHP creando una vulnerabilidad de Inyección de Objetos. También había un método mágico usable en el plugin que podía ser usado para lograr una ejecución de código remota • https://wpscan.com/vulnerability/509f2754-a1a1-4142-9126-ae023a88533a https://www.wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin • CWE-502: Deserialization of Untrusted Data •