WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. wordpress WOOCS has a cross-site scripting vulnerability that stems from the product's failure to effectively handle...

WordPress WOOCS – Currency Switcher for WooCommerce plugin <= 1.3.7.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WOOCS – Currency Switcher for WooCommerce plugin versions = 1.3.7.4. Solution Update the WordPress WOOCS – Currency Switcher for WooCommerce plugin to the latest available version at least 1.3.7.5...

Creston Web Interface 1.0.0.2159 - Credential Disclosure

Exploit Title: Creston Web Interface 1.0.0.2159 - Credential Disclosure Exploit Author: RedTeam Pentesting GmbH Advisory: Credential Disclosure in Web Interface of Crestron Device When the administrative web interface of the Crestron HDMI switcher is accessed unauthenticated, user credentials are...

CVE-2022-23178

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname...

CVE-2022-23178

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname...

Design/Logic Flaw

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname...

Crestron HD-MD4X2-4K-E 1.0.0.2159 Credential Disclosure Vulnerability

Crestron HD-MD4X2-4K-E version 1.0.0.2159 suffers from a credential disclosure vulnerability. When the administrative web interface of the Crestron HDMI switcher is accessed unauthenticated, user credentials are disclosed which are valid to authenticate to the web interface. Credential Disclosure...

Crestron Hd-Md4X2-4K-E 授权问题漏洞

The Crestron Hd-Md4X2-4K-E is a simple to use, four Hdmi input and two Hdmi output Ultra HD signal switcher from Crestron USA. A security vulnerability exists in the Crestron HD-Md4X2-4K-E 1.0.0.2159, which allows an unauthenticated attacker accessing the management web interface of a Crestron HD...

WordPress WOOCS – Currency Switcher for WooCommerce plugin <= 1.3.7.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WOOCS – Currency Switcher for WooCommerce plugin versions = 1.3.7.2. Solution Update the WordPress WOOCS – Currency Switcher for WooCommerce plugin to the latest available version at least 1.3.7.3...

CVE-2021-24938 WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting

The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocsupdateprofilesdata AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected cross-Site Scripting issue...

WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the key parameter of the woocsupdateprofilesdata AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected cross-Site Scripting issue PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...

WordPress WOOCS – Currency Switcher for WooCommerce plugin <= 1.3.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress WOOCS – Currency Switcher for WooCommerce plugin versions = 1.3.7. Solution Update the WordPress WOOCS – Currency Switcher for WooCommerce plugin to the latest available version at least 1.3.7.1...

WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the key parameter of the woocsupdateprofilesdata AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected cross-Site Scripting issue " / var form1 = document.getElementById'hack'; form1.submit; POST...

CVE-2020-23054

A cross-site scripting XSS vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the user agent input field...

CVE-2020-23054

A cross-site scripting XSS vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the user agent input field...

Cross site scripting

A cross-site scripting XSS vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the user agent input field...

CVE-2020-23054

A cross-site scripting XSS vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the user agent input field...

CVE-2020-23054

CVE-2020-23054 is a cross-site scripting (XSS) vulnerability in NSK User Agent String Switcher Service v0.3.5. The flaw allows an attacker to execute arbitrary web scripts or HTML through a crafted payload in the user agent input field. Documented impact ranges from partial integrity impact and l...

Nsk User Agent String Switcher Service 跨站脚本漏洞

Nsk User Agent String Switcher Service is an open source extension . It is used to pre-detect the user agent strings seen by web servers and client code when visiting a website. A security vulnerability exists in NSK User Agent String Switcher Service that allows an attacker to execute arbitrary...

WordPress Catch Duplicate Switcher plugin <= 1.5.2 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Duplicate Switcher plugin versions = 1.5.2. Solution Update the WordPress Catch Duplicate Switcher plugin to the latest available version at least 1.6...