WordPress Event Tickets with Ticket Scanner plugin <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Event Tickets with Ticket Scanner versions = 2.4.3...

PT-2024-39898

Name of the Vulnerable Software and Affected Versions Event Tickets with Ticket Scanner plugin for WordPress versions prior to 2.4.4 Description The issue is related to Stored Cross-Site Scripting via the data parameters due to insufficient input sanitization and output escaping, as well as missi...

WordPress plugin Event Tickets with Ticket Scanner 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-9866: Improper Neutralization of Input During Web Page Generation

The Event Tickets with Ticket Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping and missing authorization on the functionality to manage tickets...

CVE-2024-12123

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the...

CVE-2024-12123 Unauthorized Modification of Ticket Requester

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the...

CVE-2024-12123 Unauthorized Modification of Ticket Requester

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the...

CVE-2024-12123

CVE-2024-12123 affects Issuetrak v17.1. A hidden field manipulation flaw allows an authenticated user submitting a ticket to have the request intercepted and modified via a proxy, changing the ticket requester to another user in the same application, which the app accepts. The issue is described ...

CVE-2024-11479 Authenticated HTML Injection in Issuetrak Ticket Comment Function

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket...

CVE-2024-11479 Authenticated HTML Injection in Issuetrak Ticket Comment Function

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket...

CVE-2024-11479

CVE-2024-11479 concerns Issuetrak 17.1. An authenticated user can inject HTML into ticket comments, which is then rendered in emails sent to all users on that ticket. The affected component is the comment handling in tickets; the root cause is HTML injection in comments. Publicly stated impact is...

CVE-2024-12123: External Control of Assumed-Immutable Web Parameter

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the...

CVE-2024-11479: Improper Neutralization of Input During Web Page Generation

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket...

PT-2024-17449 · Issuetrak · Issuetrak

Name of the Vulnerable Software and Affected Versions: Issuetrak version 17.1 Description: A hidden field manipulation issue was identified that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and modified by using a proxy...

PT-2024-17019

Name of the Vulnerable Software and Affected Versions Issuetrak version 17.1 Description A HTML Injection issue was identified that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on...

Malicious code in spinal-service-ticket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aae35c4e4ff6906cb7d4d11279ee76155e4fe161e95d96ecea1f4e61e9a67412 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-41407 · Dit +1 · Webkitgtk-4.0-Lang +63

Уязвимость OpenSUSE...

CVE-2024-11970

A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tourcor.php. The manipulation of the argument mai leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-11970

A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tourcor.php. The manipulation of the argument mai leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-11970 code-projects Concert Ticket Ordering System tour(cor).php sql injection

A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tourcor.php. The manipulation of the argument mai leads to sql injection. It is possible to launch the attack remotely. The exploit has been...