WPC Smart Wishlist for WooCommerce < 2.9.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the key parameter before outputting it back in the wishlistquickview AJAX action's response available to any authenticated user, leading to a Reflected Cross-Site Scripting PoC The source and destination should use the https:// protocol for the exploit to...

WordPress WPC Smart Wishlist for WooCommerce plugin <= 2.9.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WPC Smart Wishlist for WooCommerce plugin versions = 2.9.3. Solution Update the WordPress WPC Smart Wishlist for WooCommerce plugin to the latest available version at least 2.9.4...

WordPress Smart Protect plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Smart Protect plugin versions = 1.1. Solution No patched version available...

NFT tranfered to market directly can be took by anyone

Lines of code Vulnerability details Proof of Concept 1. Offer can be made on any NFT if: 1. Not in active auction 2. No existing offer 3. The new offer amount is greater than existing offer 1. No access control on acceptOffer , anyone can send tx and reach this line which lead to transfer from...

WordPress WP Smart Export (Free) plugin <= 1.4.2.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Smart Export Free plugin versions = 1.4.2.3. Solution No patched version available...

WordPress WP Smart Export (Free) plugin <= 1.4.2.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Smart Export Free plugin versions = 1.4.2.3. Solution No patched version available...

WordPress Smart Admin Menu Filter plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Smart Admin Menu Filter plugin versions = 1.0.1. Solution No patched version available...

WordPress Smart Tools for WooCommerce plugin <= 1.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Smart Tools for WooCommerce plugin versions = 1.0.8. Solution Update the WordPress Smart Tools for WooCommerce plugin to the latest available version at least 1.0.9...

WordPress Smart Protect plugin <= 1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Smart Protect plugin versions = 1.1. Solution No patched version available...

GSD-2022-1000283 Multiple vulnerabilities in NFT version All

A phishing attack was conducted against users of the Opensea.io NFT platform, resulting in 17 users losing approx. $1.7 Million USD in NFTs. This incident appears to include email phishing, a fake website, bad wallet UI that make it difficult for users to know exactly what is going on and use of...

Hackers Stole $1.7 Million Worth of NFTs from Users of OpenSea Marketplace

Malicious actors took advantage of a smart contract upgrade process in the OpenSea NFT marketplace to carry out a phishing attack against 17 of its users that resulted in the theft of virtual assets worth about $1.7 million. NFTs, short for non-fungible tokens, are digital tokens that act like...

NFT Investors Lose $1.7M in OpenSea Phishing Attack

Over the weekend, hackers stole millions of dollars worth of non-fungible tokens NFTs belonging to 17 members of the OpenSea NFT marketplace. On Saturday, a small number of OpenSea users noticed their NFTs were missing. NFTs are digital tokens on the blockchain that represent ownership over virtu...

Phishing scam: NFTs Worth $1.7M Stolen from OpenSea Users

By Deeba Ahmed OpenSeas CEO Devin Finzer has denied the claims that a vulnerability in their smart contract was exploited to… This is a post from HackRead.com Read the original post: Phishing scam: NFTs Worth $1.7M Stolen from OpenSea Users...

D-Link Dir-823-Pro Command Injection Vulnerability (CNVD-2022-15175)

D-Link Dir-823-Pro is a dual-band smart wireless router from China Youxun D-Link. D-Link DIR-823-Pro v1.0.2 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the sambaname parameter...

smart.uniglobe.nl Cross Site Scripting vulnerability OBB-2380242

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

User can't create TurboSafe through TurboMaster.createSafe()

Lines of code Vulnerability details Impact A user can't create a safe because of the requiresAuth modifier in createSafe. Neither directly through the TurboMaster contract nor through the router. Proof of Concept Here's the test file I used to confirm it. I had to modify the contracts a little bi...

Microsoft Warns of 'Ice Phishing' Threat on Web3 and Decentralized Networks

Microsoft has warned of emerging threats in the Web3 landscape, including "ice phishing" campaigns, as a surge in adoption of blockchain and DeFi technologies emphasizes the need to build security into the decentralized web while it's still in its early stages. The company's Microsoft 365 Defende...

‘Ice phishing’ on the blockchain

The technologies that connect us are continually advancing, and while this brings tremendous new capabilities to users, it also opens new attack surfaces for adversaries and abusers. Social engineering represents a class of threats that has extended to virtually every technology that enables huma...

‘Ice phishing’ on the blockchain

The technologies that connect us are continually advancing, and while this brings tremendous new capabilities to users, it also opens new attack surfaces for adversaries and abusers. Social engineering represents a class of threats that has extended to virtually every technology that enables huma...

Smart Forms < 2.6.71 - Subscriber+ Form Data Download

The plugin does not have authorisation in its rednaosmartformsentrieslist AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form. Execute the below command in the web develop...