CVE-2023-23688

CVE-2023-23688 is a stored XSS vulnerability in the WordPress plugin Social Share Boost, affecting versions up to 4.4. The flaw requires authentication (contributor+), permitting stored XSS via the plugin’s functionality. Public advisories consistently reference the same CVE and indicate vulnerab...

WordPress plugin Social Share Boost 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

PT-2023-19132 · WordPress · Sumo Social Share Boost

Name of the Vulnerable Software and Affected Versions: Sumo Social Share Boost plugin versions = 4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication and affects users with contributor or higher permissions...

CVE-2018-25032 affecting package boost 1.66.0-3

CVE-2018-25032 affecting package boost 1.66.0-3. A patched version of the package is available...

CVE-2018-25032 affecting package boost for versions less than 1.76.0-3

CVE-2018-25032 affecting package boost for versions less than 1.76.0-3. A patched version of the package is available...

WordPress Social Share Boost Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)

Software Social Share Boost Type Plugin Vulnerable versions = 4.4 Fixed in 4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23688 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 30c318520be9 Credits István Márton Required...

UI Desktop 安全漏洞

UI Desktop is a desktop management software from the UI community. A security vulnerability exists in UI Desktop versions prior to 0.62.3, which stems from a local boost vulnerability that can be exploited by an attacker to submit arbitrary commands as SYSTEM...

New S1deload Malware Hijacking Users' Social Media Accounts and Mining Cryptocurrency

An active malware campaign has set its sights on Facebook and YouTube users by leveraging a new information stealer to hijack the accounts and abuse the systems' resources to mine cryptocurrency. Bitdefender is calling the malware S1deload Stealer for its use of DLL side-loading techniques to get...

K16946: Boost memory allocator vulnerability CVE-2012-2677

Security Advisory Description Integer overflow in the orderedmalloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to ...

SUSE CVE-2008-0171

regex/v4/perlmatchernonrecursive.hpp in the Boost regex library aka Boost.Regex in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service failed assertion and crash via an invalid regular expression...

SUSE CVE-2008-0172

The getrepeattype function in basicregexcreator.hpp in the Boost regex library aka Boost.Regex in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service NULL dereference and crash via an invalid regular expression...

SUSE CVE-2012-2677

Integer overflow in the orderedmalloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected...

SUSE CVE-2013-0252

boost::locale::utf::utftraits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes...

SUSE CVE-2020-7237

Cacti 1.2.8 allows Remote Code Execution by privileged users via shell metacharacters in the Performance Boost Debug Log field of pollerautomation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance...

Vault creator can prevent users from claiming staking rewards

Lines of code Vulnerability details Impact Vault creator can prevent users from claiming rewards from the staking contract. This can boost his liquidity and lure depositors to stake vault tokens. He can present a high APY and low fee percentage which will incentivize stakers When the staking...

8base-chat (2.2.1), @8base/boost (>=0.22.0, <=1.12.1) +261 more potentially affected by CVE-2023-22467 via luxon (>=1.0.0, <=1.28.0)

luxon NPM version =1.0.0, =0.22.0, =0.0.25, =1.0.0-alpha.6, =0.0.1-alpha.27, =0.0.1-alpha.27, =0.0.1-alpha.27, =0.3.0, =0.0.0-nightly-202111221544, =0.8.1, =0.12.4, =0.6.5, =0.12.0, =0.0.1, =0.0.46 and more Source cves: CVE-2023-22467 Source advisory: OSV:GHSA-3XQ5-WJFH-PPJC...

Malicious code in boost-for-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8da6dcc96b2c067367ff27f7f02a880d0e12449e6bf8595898ca728c7e6a3376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1647 Malicious code in boost-for-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8da6dcc96b2c067367ff27f7f02a880d0e12449e6bf8595898ca728c7e6a3376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

多款TRUMPF产品安全漏洞

TRUMPF TruTops and others are TRUMPF products.TRUMPF TruTops is TRUMPF Oseon is an integrated solution for production and material flow control.TRUMPF Job Order Interface is a software job order interface. A security vulnerability exists in several TRUMPF products that stems from the use of defau...

CVE-2022-25302

All versions of package asneg/opcuastack are vulnerable to Denial of Service DoS due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in OpcUaNodeIdBase.h. Exploiting this vulnerability is possible when sending a specifically crafted OPC UA message...