Open redirect on "Unsupported browser" warning

None...

End-to-End encrypted file-drops can be made inaccessible

None...

GHSA-Q9HG-9QJ2-MXF9 XWiki Platform vulnerable to cross-site scripting via xcontinue parameter in previewactions template

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as:...

A week in security (June 12 - 18)

Last week on Malwarebytes Labs: MOVEit discloses THIRD critical vulnerability Fake security researchers push malware files on GitHub LockBit ransomware advisory from CISA provides interesting insights Microsoft fixes six critical vulnerabilities in June Patch Tuesday Update Chrome now! Google fix...

How Ticket Scalping Impacts Asia’s Live Entertainment Industry

Asia’s booming live entertainment industry has recently been plagued by a growing problem of ticket scalping. The term refers to the act of purchasing live event tickets in bulk by individuals, often through the use of automation aka bots, to later resell them at exorbitant prices. The issue isn’...

Ticket scammers target Taylor Swift tour

Taylor Swift fans are being warned to be cautious when buying tickets for her current "Eras" tour, with scammers waiting in the wings to trick would-be gig goers. The Better Business Bureau says it has received somewhere in the region of 200 complaints from residents of Michigan, and theres bound...

CLSA-2023-1685971623 Fix CVE(s): CVE-2022-45141

SECURITY UPDATE: Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets - debian/patches/CVE-2022-45141.patch: fix TGS ticket enc-part key selection and check-des - CVE-2022-45141...

WooCommerce Box Office < 1.1.52 - Unauthenticated Ticket Barcode Update

The plugin does not have authorisation and CSRF when updating a ticket bar-code, allowing unauthenticated users to perform such action curl https://example.com/wp-admin/admin-ajax.php -d "action=saveticketbarcode&ticketbarcodeimage=xxx&ticketbarcodetext=xxxxx&ticketid=86"...

HackerOne: Create miscellaneous support ticket on anyone's account through [email protected] email

A vulnerability was discovered where an attacker could create support tickets on anyone's account by sending a fake email to [email protected]. This allowed the attacker to create tickets on behalf of victims or even HackerOne staff. The issue was resolved internally and the created tickets...

CVE-2023-2865

A vulnerability was found in SourceCodester Theme Park Ticketing System 1.0. It has been classified as critical. This affects an unknown part of the file printticket.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate...

user_oidc app is missing bruteforce protection

None...

PT-2023-21874 · Sourcecodester · Sourcecodester Theme Park Ticketing System

Name of the Vulnerable Software and Affected Versions: SourceCodester Theme Park Ticketing System version 1.0 Description: A critical issue affects the GET Parameter Handler component in the print ticket.php file, allowing for SQL injection through the manipulation of the id argument. This can be...

CVE-2023-2715

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...

CVE-2023-2715

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...

CVE-2023-2715

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...

Design/Logic Flaw

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...

CVE-2023-2715 Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...

PT-2023-20975 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is due to a missing capability check on the submit ticket function, allowing authenticated attackers to create a support ticket that sends the...

Groundhogg < 2.7.8.9 - Ticket Creation via CSRF

The plugin does not have CSRF check when creating a support ticket to the plugin author, which could allow attackers to make logged-in admins perform such action via a CSRF attack...

CVE-2023-31597

An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existing tickets...