Cookie Bar <= 1.8.8 - Admin+ Stored Cross-Site Scripting

The plugin doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Add the following payload in the "Cookie Bar Message" setting of the plugin...

WordPress Cookie Bar plugin <= 1.8.8 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by pang0lin in WordPress Cookie Bar plugin versions = 1.8.8. Solution Update the WordPress Cookie Bar plugin to the latest available version at least 1.8.9...

Cookie Bar <= 1.8.8 - Admin+ Stored Cross-Site Scripting

The plugin doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Add the following payload in the "Cookie Bar Message" setting of the plugin...

WordPress Catch Scroll Progress Bar plugin <= 1.5 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Scroll Progress Bar plugin versions = 1.5. Solution Update the WordPress Catch Scroll Progress Bar plugin to the latest available version at least 1.6...

Cross-site Scripting (XSS) - DOM in mineweb/minewebcms

✍️ Description A malicious actor is able to add a malicious payload as a new Navigation Bar Link Title, and after every time any users visit the main root page of the website, the XSS payload is executed and the session of whoever visits the site is compromised. 🕵️‍♂️ Proof of Concept 1; Create a...

CVE-2021-24431

The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting...

CVE-2021-24431

CVE-2021-24431 affects the Language Bar Flags WordPress plugin (versions

CVE-2021-24431 Language Bar Flags <= 1.0.8 - CSRF to Stored XSS

The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting...

CVE-2020-27970

Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar...

CVE-2020-27969

Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing...

CVE-2020-27969

Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing...

Design/Logic Flaw

Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar...

Spoofing

Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing...

CVE-2020-27970

Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar...

CVE-2020-27970

CVE-2020-27970 affects Yandex Browser prior to 20.10.0. The vulnerability stems from insufficient validation of the address bar’s authenticity, enabling remote attackers to spoof the address bar. Public sources in the connected documents consistently reference “Yandex Browser before 20.10.0 allow...

CVE-2020-27969

CVE-2020-27969 affects Yandex Browser for Android (version 20.8.4). Multiple sources describe a vulnerability enabling remote SOP bypass and address bar spoofing. The available connected documents note the software and impact but do not provide root-cause details or a published fix/remediation. I...

CVE-2020-27969

Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing...

Yandex Browser 安全漏洞

Yandex Browser is a desktop version of the web browser from the Russian company Yandex. A security vulnerability exists in Yandex Browser versions prior to 20.10.0, which stems from the software's lack of sufficient validation of the authenticity of the address bar. This allows remote attackers t...

Yandex Browser 访问控制错误漏洞

Yandex Browser is a desktop version of a web browser from the Russian company Yandex. A security vulnerability exists in Yandex Browser Android version 20.8.4, which allows remote attackers to perform SOP bypass and address bar spoofing...

WordPress plugin Bar Flags跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...