CVE-2022-30578 TIBCO EBX Add-ons Stored XSS vulnerability

The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...

CVE-2022-30578

The CVE-2022-30578 vulnerability affects the Web Server component of TIBCO EBX Add-ons, with versions 5.4.1 and earlier being vulnerable. The issue enables a stored XSS condition that an attacker with network access and low privileges can trigger, requiring user interaction for exploitation. A fi...

CVE-2022-30578 TIBCO EBX Add-ons Stored XSS vulnerability

The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...

PT-2022-20186 · Tibco Software · Tibco Ebx Add-Ons

Name of the Vulnerable Software and Affected Versions: TIBCO EBX Add-ons versions 5.4.1 and below Description: The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site...

TIBCO Security Advisory: September 21, 2022 - TIBCO EBX Add-ons -CVE-2022-30578

TIBCO EBX Add-ons Stored XSS vulnerability Original release date: September 21, 2022 Lastrevised: --- CVE-2022-30578 Source: TIBCOSoftware Inc. Products Affected TIBCO EBX Add-ons versions 5.4.1 and below The following component is affected: Web Server Description The component listed above...

Experts Uncover 350 Browser Extension Variants Used in ABCsoup Adware Campaign

A malicious browser extension with 350 variants is masquerading as a Google Translate add-on as part of an adware campaign targeting Russian users of Google Chrome, Opera, and Mozilla Firefox browsers. Mobile security firm Zimperium dubbed the malware family ABCsoup, stating the "extensions are...

Critical Bug in Everscale Wallet Could've Let Attackers Steal Cryptocurrencies

A security vulnerability has been disclosed in the web version of the Ever Surf wallet that, if successfully weaponized, could allow an attacker to gain full control over a victim's wallet. "By exploiting the vulnerability, it's possible to decrypt the private keys and seed phrases that are store...

Cross site request forgery (csrf)

DISPUTED A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a...

CVE-2021-45268

A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...

PT-2022-12317 · Unknown · Backdrop Cms

Name of the Vulnerable Software and Affected Versions: Backdrop CMS version 1.20 Description: A Cross Site Request Forgery CSRF issue exists, allowing remote attackers to gain Remote Code Execution RCE on the hosting web server via uploading a malicious add-on with a crafted PHP file. The attack...

Cross site scripting

The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network...

CVE-2019-11723

A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This...

Mozilla Firefox Blocks Malicious Add-ons Installed by 455K Users

Mozilla’s Firefox team has blocked add-ons that were abusing the proxy API in order to prevent around 455,000 users from updating their browsers. In a Monday post, Mozilla’s development team members Rachel Tublitz and Stuart Colville said that they’d discovered the misbehaving add-ons in early...

Patch now to bypass Firefox add-ons that abuse the proxy API to deny updates

In a Firefox security announcement, Mozilla said 455,000 users have downloaded Firefox add-ons that interfere with how they connect to the internet. The interference in itself was not the deciding factor, however. The add-ons abused the proxy API to prevent users who had installed them from...

Malicious Firefox Add-ons Block Browser From Downloading Security Updates

Mozilla on Monday disclosed it blocked two malicious Firefox add-ons installed by 455,000 users that were found misusing the Proxy API to impede downloading updates to the browser. The two extensions in question, named Bypass and Bypass XM, "interfered with Firefox in a way that prevented users w...

YITH WooCommerce Product Add-Ons < 2.1.0 - Authenticated Local File Inclusion

The plugin does not validate user input before using it to generate a local path passed to include, which could lead to a Local File Inclusion issue on Windows Web Servers https://example.com/wp-admin/admin.php?page=yithwapopanel&tab=blocks&blockid=1&addonid=1&addontype=html%2F..%2Fhello...

Multiple WooCommerce Add-Ons - Low Priv Arbitrary Blog Options Update/Access/Deletion & Plugin's Settings Update/Export/Import

The svxajaxfactory AJAX action of the plugins, available to authenticated users, do not have CSRF and capability checks, which could allow any authenticated user, such as subscriber to change/view/delete arbitrary WordPress options, retrieve the list of users, import/export/update the plugins'...

YITH WooCommerce Product Add-Ons < 2.1.0 - Authenticated Local File Inclusion

The plugin does not validate user input before using it to generate a local path passed to include, which could lead to a Local File Inclusion issue on Windows Web Servers PoC https://example.com/wp-admin/admin.php?page=yithwapopanel=blocksid=1id=1type=html%2F..%2Fhello...

YITH WooCommerce Product Add-Ons < 2.1.0 - Reflected Cross-Site Scripting

The plugin does not escape some parameters before outputting them back in the edit addon page in the admin dashboard, leading to Reflected Cross-Site Scripting issues PoC v type=html" v 2.1.0 https://example.com/wp-admin/admin.php?page=yithwapopanel=blocksid=1id=1type=html" accesskey=X...

YITH WooCommerce Product Add-Ons < 2.1.0 - Reflected Cross-Site Scripting

The plugin does not escape some parameters before outputting them back in the edit addon page in the admin dashboard, leading to Reflected Cross-Site Scripting issues v alert/XSS-id/&addontype=html"alert/XSS-type/ v 2.1.0...