SoftEtherVPN -- multiple vulnerabilities

Daiyuu Nobori reports: The SoftEther VPN project received a high level code review and technical assistance from Cisco Systems, Inc. of the United States from April to June 2023 to fix several vulnerabilities in the SoftEther VPN code. The risk of exploitation of any of the fixed vulnerabilities ...

7-Eleven LED Message Cup 安全漏洞

7-Eleven Bluetooth Smart Cup is a smart Bluetooth cup from 711 7-Eleven USA. A security vulnerability exists in 7-Eleven LED Message Cup version 1.3.1, which stems from a vulnerability that allows an unauthenticated attacker to bypass the application's client-side chat review filter...

onlinecoursesreview.org Cross Site Scripting vulnerability OBB-3465303

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-28751

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...

CVE-2023-28751

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...

CVE-2023-28751

CVE-2023-28751 affects WP Ultimate Review (Wpmet) plugin

CVE-2023-28751 WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...

VMware Releases Security Update for vCenter Server and Cloud Foundation

VMware has released a security update to address multiple memory corruption vulnerabilities in vCenter Server and Cloud Foundation. A cyber threat actor could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review VMware Security...

Pre-defined limit is different from the spec.

Lines of code Vulnerability details Impact In the spec, the pre-defined limit of ETH is 0.01 ETHs. But the actual limit in the code is not 0.01 ETH which could result in misleading. Proof of Concept In the spec, it said that the pre-defined limit of ETH is 0.01 ETHs For risk management purposes, ...

WordPress plugin Wp Ultimate Review 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

AutoSwapThreshold field is not checked for exceeding MaxAutoSwapThreshold constant

Lines of code Vulnerability details Impact validateAutoSwapThreshold function has a problem that does not check the AutoSwapThreshold field is less than or equal to the MaxAutoSwapThreshold constant, this can caused that a malicious user could set the AutoSwapThreshold field to a value that is...

Almost all of the github.com/cosmos/cosmos-sdk/types will be deprecated

Lines of code Vulnerability details Impact Codes in the scope won't work if the would be updated. Proof of Concept It is clearly seen that in the it is fixed version of v0.45.9. However, in next version of cosmos-sdk all of the Int methods will be deprecated. Almost all of the code in the scope i...

GetPoolByLptDenom function does not check if lptDenom string is valid

Lines of code Vulnerability details Impact To check if the lptDenom string is valid The GetPoolByLptDenom function in the keeper package do that job so that is the problem, So an attacker can pass in a malicious lptDenom string that would cause the function to return a non-existent liquidity pool...

Canto pool could be drained.

Lines of code Vulnerability details Impact It was written that there a limit for 10 USDC /10 USDT /0.01 ETH, which currently equals to 10 USDT/ 10 USDC/ 18 USDT almost. These limits are for 4 Canto. Which means code accepts the Canto price at max: 2,5 USDC or equavalent. It is also written in the...

PT-2023-21938 · WordPress · Wpmet Wp Ultimate Review

Name of the Vulnerable Software and Affected Versions: Wpmet Wp Ultimate Review plugin versions = 2.0.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Wpmet Wp Ultimate Review...

CVE-2023-28774

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Grade Us, Inc. Review Stream plugin = 1.6.5 versions...

CVE-2023-28774

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Grade Us, Inc. Review Stream plugin = 1.6.5 versions...

CVE-2023-28774 WordPress Review Stream Plugin <= 1.6.5 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Grade Us, Inc. Review Stream plugin = 1.6.5 versions...

CVE-2023-28774 WordPress Review Stream Plugin <= 1.6.5 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Grade Us, Inc. Review Stream plugin = 1.6.5 versions...

WordPress plugin Review Stream 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...