2064 matches found
WordPress Event Tickets with Ticket Scanner plugin < 2.3.8 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Anas Jamal and Satyam Singh in WordPress Plugin Event Tickets with Ticket Scanner versions 2.3.8...
WordPress Event Tickets with Ticket Scanner Plugin < 2.3.8 is vulnerable to Cross Site Scripting (XSS)
Software Event Tickets with Ticket Scanner Type Plugin Vulnerable versions 2.3.8 Fixed in 2.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6711 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0bf7f36b041a Credits Anas Jam...
CVE-2024-43138 WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1...
CVE-2024-43138 WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1...
ROS-20240808-04
A vulnerability in the phpCAS::setUrl function of the phpCAS authentication library is related to the use of HTTP headers to determine the URL of a service used to validate tickets. HTTP to determine the URL of the service used to validate tickets, allowing the control of the host header and use ...
WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin WpEvently versions = 4.2.1...
CVE-2024-6200 HaloITSM - Stored Cross-Site Scripting in Tickets
HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting XSS vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 and patches starting from 2.143.61 fix the mentioned vulnerability...
CVE-2024-6200 HaloITSM - Stored Cross-Site Scripting in Tickets
HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting XSS vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 and patches starting from 2.143.61 fix the mentioned vulnerability...
CVE-2024-7446
A vulnerability, which was classified as critical, was found in itsourcecode Ticket Reservation System 1.0. This affects an unknown part of the file listtickets.php. The manipulation of the argument prefSeatid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...
Ticket Reservation System SQL注入漏洞
Ticket Reservation System is itsourcecode open source ticket reservation system. Ticket Reservation System version 1.0 has a SQL injection vulnerability, the vulnerability stems from the prefSeatid parameter of the listtickets.php file contains a SQL injection vulnerability...
PT-2024-38356 · Unknown · Itsourcecode Ticket Reservation System
Name of the Vulnerable Software and Affected Versions: itsourcecode Ticket Reservation System version 1.0 Description: A critical issue was found in the itsourcecode Ticket Reservation System, affecting the file list tickets.php. The manipulation of the prefSeat id argument leads to SQL injection...
CVE-2024-6033 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'importfile' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers,...
SUSE CVE-2024-6540
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has be...
CVE-2024-2691: Improper Neutralization of Input During Web Page Generation
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on use...
A week in security (July 8 – July 14)
Last week on Malwarebytes Labs: "Nearly all" AT&T customers had phone records stolen in new data breach disclosure Fake Microsoft Teams for Mac delivers Atomic Stealer Dangerous monitoring tool mSpy suffers data breach, exposes customer details iPhone users in 98 countries warned about spyware by...
PT-2024-37700 · Otrs · Otrs
Name of the Vulnerable Software and Affected Versions: OTRS versions 8.0.X through 2024.4.x OTRS version 2023.X Description: The issue is related to improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS. This could allow an authorized...
WordPress Event Tickets and Registration plugin <= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Event Tickets versions = 5.11.0.4...
WordPress Event Tickets Plugin <= 5.11.0.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Event Tickets Type Plugin Vulnerable versions = 5.11.0.4 Fixed in 5.11.0.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-38762 Patch priority Low CVSS severity Low 4.3 Developer Liquid Web / StellarWP PSID 0a615d084880 Credits Joshua...
CVE-2024-37147 GLPI allows Authenticated File Upload to Restricted Tickets
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...
Ticketmaster says stolen Taylor Swift Eras Tour tickets are useless
While cybercriminals are offering free tickets to Taylor Swift Eras Tour and other events, Ticketmaster is telling would-be purchasers that these tickets will prove to be worthless. Those who have claimed responsibility for the Ticketmaster data breach say they’ve stolen 440,000 tickets for Taylo...