WordPress Plugin Event Manager and Tickets Selling Plugin for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-28422: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce = 3.8.6. versions...

CLSA-2023-1679000956 Fix CVE(s): CVE-2022-45141

SECURITY UPDATE: AD DC can be forced to issue rc4-hmac Kerberos tickets - debian/patches/CVE-2022-45141.patch: fix session key selection algorithm for selecting the ticket in strongest-to-weakest order, thus allowing the target server to select better encryption - CVE-2022-45141...

golang: crypto/tls: session tickets lack random ticket_age_add

A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption...

CVE-2022-47440

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Tickets plugin = 1.9.10 versions...

CVE-2022-47440

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Tickets plugin = 1.9.10 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Tickets plugin = 1.9.10 versions...

CVE-2022-47440 WordPress My Tickets Plugin <= 1.9.10 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Tickets plugin = 1.9.10 versions...

CVE-2022-47440

CVE-2022-47440 is a CSRF vulnerability affecting WordPress My Tickets plugin versions ≤ 1.9.10. The issue stems from missing CSRF protection, enabling unauthorized actions via CSRF (e.g., bulk emailing) as described in connected entries. Mitigation: upgrade to version &gt; 1.9.10 (fixed in 1.9.11...

CVE-2022-47440 WordPress My Tickets Plugin <= 1.9.10 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Tickets plugin = 1.9.10 versions...

WordPress plugin My Tickets 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-15316 · Joseph C Dolson · My Tickets

Name of the Vulnerable Software and Affected Versions: Joseph C Dolson My Tickets plugin versions = 1.9.10 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

CVE-2022-47440: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Tickets plugin = 1.9.10 versions...

orlandostormtickets.com Cross Site Scripting vulnerability OBB-3219327

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3 libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

...

Expected payout should not be determined off-chain

Lines of code Vulnerability details Impact Loss of profit and depletion of funds, the latter of which implies that some tickets will be unclaimable. Proof of Concept There is no guarantee to the correctness of LotterySetupParams.expectedPayout, which can be set freely within bounds in...

Malicious user can frontrun the selling or transferring of a ticket to claim the rewards

Lines of code Vulnerability details A bad actor can trick a user into buying an unclaimed ticket and frontrun the selling or transfer of the NFT to claim the rewards associated with the ticket before the original transaction. Impact Given the described scenario, a bad actor can frontrun the...

claimPerDraw() can accounts for referrals after the ticket registration deadline

Lines of code Vulnerability details When accounting for referrals, the beforeTicketRegistrationDeadline ensure tickets cannot be purchased after the draw registration deadline. The issue is that the referral registration happens for the current draw regardless of which draw the tickets are...

referralRegisterTickets there is an inaccurate calculation of the total number of tickets for referrers

Lines of code Vulnerability details Impact There is an inaccurate total ticket count for referrers, that is, when the number of unclaimed tickets for referrers has reached the minimum EligibleReferralscurrentDraw, but when the number of referrer tickets is added to the new number of tickets will...

Lottery Insolvency can lead to unclaimable winning tickets despite paying out Frontend and Staking rewards

Lines of code Vulnerability details Impact Lottery Insolvency can lead to unclaimable winning tickets despite paying out Frontend and Staking rewards Proof of Concept When distributing the winning tokens, it is possible that there is an insufficient balance to be able to pay winning tickets while...