SUSE CVE-2020-10369

Certain Cypress and Broadcom Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra" attack...

SUSE CVE-2020-10370

Certain Cypress and Broadcom Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via a "Spectra" attack...

SUSE CVE-2020-10368

Certain Cypress and Broadcom Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack...

Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

The plugin does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks. Note: The exploit requires the Contact Form 7 plugin. Exploit Additional CSS classes for “Contact Form 7 Styler” Gutenberg block: ...

Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

The plugin does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks. PoC Note: The exploit requires the Contact Form 7 plugin. Exploit Additional CSS classes for “Contact Form 7 Styler” Gutenberg...

WordPress Spectra Plugin < 1.15.0 is vulnerable to Cross Site Scripting (XSS)

Software Spectra Type Plugin Vulnerable versions 1.15.0 Fixed in 1.15.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2020-36656 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID aa21c4e7af94 Credits István Márton Required...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Content Injection

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-23735 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID df80536f36d8 Credits Dave Jong Patchstack Required privilege Unauthenticat...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Content Spoofing

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A1: Injection Classification Content Spoofing CVE CVE-2023-23738 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 03ab7b057204 Credits Dave Jong Patchstack Required privilege Unauthenticate...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Broken Access Control

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23825 Patch priority Low CVSS severity Low 3.1 Developer Claim ownership PSID f5fec0c1297d Credits István Márton Required privilege...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Broken Access Control

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23729 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 16166b135120 Credits Dave Jong Patchstack Required privile...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Bypass Vulnerability

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-23730 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e0584f9e90cf Credits Dave Jong Patchstack Required...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Broken Access Control

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23834 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b8d689e47cd6 Credits István Márton Required privilege...

spectra-online.ch Cross Site Scripting vulnerability OBB-3108349

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Spectra plugin <= 1.25.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Spectra plugin versions = 1.25.5. Solution Update the WordPress Spectra plugin to the latest available version at least 1.25.6...

Spectra < 1.25.6 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC When the admin notice about Usage Tracking is displayed: https://example.com/wp-admin/index?a"...

Spectra < 1.25.6 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting When the admin notice about Usage Tracking is displayed: https://example.com/wp-admin/index?a"alert/XSS/...

PT-2022-8316 · Cypress · Cypress Wireless Combo

Name of the Vulnerable Software and Affected Versions: Cypress and Broadcom Wireless Combo chips versions prior to the 2021-01-26 Bluetooth firmware update Description: The issue allows a Bluetooth outage via a "Spectra" attack when a specific Bluetooth firmware update is not present. It is also...

Researchers Uncover New Coexistence Attacks On Wi-Fi and Bluetooth Chips

Cybersecurity researchers have demonstrated a new attack technique that makes it possible to leverage a device's Bluetooth component to directly extract network passwords and manipulate traffic on a Wi-Fi chip, putting billions of electronic devices at risk of stealthy attacks. The novel attacks...

SUSE: Security Advisory (SUSE-SU-2020:2733-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sectona Spectra Information Disclosure Vulnerability

Sectona Spectra is a privilege management system for enterprise device access from US-based sectona. The platform supports the consolidation of accounts in the cloud with local accounts to centralize enterprise device management and improve access security. An information disclosure vulnerability...