WordPress Login with phone number Plugin < 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Login with phone number Type Plugin Vulnerable versions 1.4.2 Fixed in 1.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23492 Patch priority High CVSS severity High 7.1 Developer Hamid Alinia PSID e0aace0379ac Credits Joshua Martinelle...

CVE-2023-23492

The Login with Phone Number WordPress Plugin, version 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwpforgotpassword' action...

CVE-2023-23492: Improper Neutralization of Special Elements used in an SQL Command

The Login with Phone Number WordPress Plugin, version 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwpforgotpassword' action...

PT-2023-6551 · WordPress · Login With Phone Number Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Login with Phone Number WordPress Plugin version 1.4.2 Description: The issue is related to an authenticated SQL injection vulnerability in the lwp forgot password action. Specifically, the vulnerability is associated with the lack of...

CVE-2023-23492

The Login with Phone Number WordPress Plugin, version 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwpforgotpassword' action...

Massive Ad Fraud Scheme Shut Down: 11 Million Phones Targeted

By Waqas The ad fraud was discovered while the researchers were investigating an iOS application that had been heavily impacted by an app spoofing attack. This is a post from HackRead.com Read the original post: Massive Ad Fraud Scheme Shut Down: 11 Million Phones Targeted...

CVE-2023-20047

A vulnerability in the Link Layer Discovery Protocol LLDP feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient resource...

CVE-2023-20047

CVE-2023-20047 affects Cisco Webex Room Phone and Cisco Webex Share with an LLDP memory/resource allocation flaw. An unauthenticated, adjacent attacker can send crafted LLDP traffic to exhaust memory, crash the LLDP process, and potentially interrupt inbound/outbound calling if LLDP is the only p...

CVE-2023-20018

CVE-2023-20018 affects Cisco IP Phone 7800 and 8800 Series through the web-based management interface. The issue is an authentication bypass caused by insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to access parts of the web interface that normally re...

CVE-2023-20018

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploi...

CVE-2023-20018: Authentication Bypass Using an Alternate Path or Channel

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploi...

CVE-2023-20047: Uncontrolled Resource Consumption

A vulnerability in the Link Layer Discovery Protocol LLDP feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient resource...

Login with Phone Number < 1.4.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the ID parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin https://example.com/wp-admin/admin-ajax.php?action=lwpforgotpassword&ID=...

Login with Phone Number < 1.4.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the ID parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC https://example.com/wp-admin/admin-ajax.php?action=lwpforgotpassword=...

Cisco IP Phone security vulnerabilities

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. A security vulnerability exists in the Cisco IP Phone 7800 and 8800 Series that stems from insufficient validation of user-supplied input...

Cisco Webex security vulnerabilities

Cisco Webex is a suite of videoconferencing and collaboration products from Cisco USA. A security vulnerability exists in Cisco Webex Room Phone that stems from an under-allocation of resources, resulting in a denial of service...

Cisco IP Phone 7800 and 8800 Series Web Management Interface Authentication Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploi...

PT-2023-1278 · Cisco · Cisco Webex Room Phone +1

Name of the Vulnerable Software and Affected Versions: Cisco Webex Room Phone affected versions not specified Cisco Webex Share affected versions not specified Description: A vulnerability in the Link Layer Discovery Protocol LLDP feature could allow an unauthenticated, adjacent attacker to cause...

PT-2023-1105 · Cisco · Cisco Ip Phone 8800 Series +1

Name of the Vulnerable Software and Affected Versions: Cisco IP Phone 7800 and 8800 Series Phones affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This...

Identifying People Using Cell Phone Location Data

The two people who shut down four Washington power stations in December were arrested. This is the interesting part: Investigators identified Greenwood and Crahan almost immediately after the attacks took place by using cell phone data that allegedly showed both men in the vicinity of all four...