Upgraded Q -> M from 234 [1659038052827]

Judge has assessed an item in Issue 234 as Medium risk. The relevant finding follows: 1. Update asset weight when calling VeTokenMinter.removeOperator When removing operator, there is no check to make sure that veAssetWeightsoperator has been removed. If governance forgot to call...

Remote code execution

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file a...

CVE-2022-24140

The CVE-2022-24140 entry affects IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot. The issue arises in the update mechanism: products fetch a config file via HTTP, parse the update location from that file, and automatically install updat...

多款IOBit产品安全漏洞

IOBit Advanced System Care Free is a system management utility. iTop Screen Recorder is a powerful free Windows screen recorder. iTop VPN is a VPN software. iTop VPN is a VPN software. IOBit Advanced System Care Free is a system management utility. iTop Screen Recorder is a product of iTop. iTop...

Booster for WooCommerce < 5.6.2 - Reflected Cross-Site Scripting

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting v alert/XSS/ v alert/XSS/...

WordPress Booster for WooCommerce plugin <= 5.5.9 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Booster for WooCommerce plugin versions = 5.5.9. Solution Update the WordPress Booster for WooCommerce plugin to the latest available version at least 5.6.0...

in VeAssetDepositor and Booster contract don't set safeApprove() to 0 first and that token uses OpenZeppelin’s ERC20 implementation

Lines of code Vulnerability details Impact OpenZeppelin’s implementation of safeApprove won't work if approved amount is not set to 0. so the logics will fail if code don't set it 0 first. Both VeToken and VE3Token use OpenZeppelin’s ERC20 implementation and VeAssetDepositor and Booster calls...

WordPress Mobile Booster plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Mobile Booster plugin versions = 1.2. Solution Update the WordPress Mobile Booster plugin to the latest available version at least 1.2.1...

WordPress "WordPress Robots.txt optimization (+ XML Sitemap) – Website traffic, SEO & ranking Booster" plugin < 1.4.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress Robots.txt optimization + XML Sitemap – Website traffic, SEO & ranking Booster" plugin versions 1.4.4. Solution Update the WordPress "WordPress Robots.txt optimization + XML Sitemap – Websit...

WordPress SEO Booster plugin < 3.8.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SEO Booster plugin versions 3.8.5. Solution Update the WordPress SEO Booster plugin to the latest available version at least 3.8.5...

WordPress SEO Booster plugin < 3.8.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SEO Booster plugin versions 3.8.5. Solution Update the WordPress SEO Booster plugin to the latest available version at least 3.8.5...

WordPress Mobile Booster plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Mobile Booster plugin versions = 1.2. Solution Update the WordPress Mobile Booster plugin to the latest available version at least 1.2.1...

WordPress Asset CleanUp: Page Speed Booster plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. Asset CleanUp:Page Speed Booster WordPress plugin prior to version 1.3.8.5 is vulnerable to a cross-site scripting vulnerability, which stems from the fact that the wpacuselectedsub tabarea parameter is...

WordPress Asset CleanUp: Page Speed Booster plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language.Asset CleanUp:Page Speed Booster WordPress plugin in versions prior to 1.3.8.5 has a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and outpu...

WordPress Asset CleanUp: Page Speed Booster Plugin < 1.3.8.5 Multiple XSS Vulnerabilities

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-24937

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacuselectedsubtabarea parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue...

Cross site scripting

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacuselectedsubtabarea parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24937

The CVE-2021-24937 entry concerns the WordPress plugin Asset CleanUp: Page Speed Booster prior to version 1.3.8.5. The root cause is improper escaping of the wpacu_selected_sub_tab_area parameter in admin-page output, enabling a Reflected Cross-Site Scripting (XSS) vulnerability. Multiple sources...

WordPress plugin 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. Asset CleanUp:Page Speed Booster WordPress plugin prior to version 1.3.8.5 is vulnerable to a cross-site scripting vulnerability, which stems from the fact that the wpacuselectedsub tabarea parameter is...

WordPress plugin跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language.Asset CleanUp:Page Speed Booster WordPress plugin in versions prior to 1.3.8.5 has a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and outpu...