SUSE CVE-2022-45141

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption...

WordPress My Tickets Plugin <= 1.9.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software My Tickets Type Plugin Vulnerable versions = 1.9.10 Fixed in 1.9.11 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47440 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 27ee056ce087 Credits rezaduty Required...

CVE-2023-0144

The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0144

The CVE-2023-0144 entry concerns the WordPress plugin Event Manager and Tickets Selling Plugin for WooCommerce (pre-3.8.0). The vulnerability is a Stored XSS that arises because the plugin does not validate/escape certain post meta before output, affecting users with the Contributor+ role. Affect...

CVE-2023-0144: Improper Neutralization of Input During Web Page Generation

The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Plugin Event Manager and Tickets Selling Plugin for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-16033

Name of the Vulnerable Software and Affected Versions Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin versions prior to 3.8.0 Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure...

CVE-2022-48023

Zammad CVE-2022-48023: A privilege-verification flaw in Zammad v5.3.0 permits an authenticated user to modify ticket tags via the API. The issue is corrected in v5.3.1, restricting tag changes to agents with write permissions. The available documents do not provide exploitation details. If using ...

The onlyMinter modifier checks the wrong condition.

Lines of code Vulnerability details Impact In RabbitHoleReceipt.sol and RabbitHoleTicket.sol, receipts and tickets can be minted by anyone. Proof of Concept The first line inside the modifier can be passed without reverting for any callers. modifier onlyMinter msg.sender == minterAddress; ; Tools...

USN-5822-1 samba vulnerabilities

It was discovered that Samba incorrectly handled the bad password count logic. A remote attacker could possibly use this issue to bypass bad passwords lockouts. This issue was only addressed in Ubuntu 22.10. CVE-2021-20251 Evgeny Legerov discovered that Samba incorrectly handled buffers in certai...

golang: crypto/tls: session tickets lack random ticket_age_add

A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption...

RHEL 8 : OpenShift Container Platform 4.11.5 (RHSA-2022:6535)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:6535 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

WordPress My Tickets Plugin <= 1.9.11 is vulnerable to Other Vulnerability Type

Software My Tickets Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A6: Security Misconfiguration Classification Other Vulnerability Type CVE CVE-2023-23988 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 857918c48e0e Credits yuyudhn Required privileg...

Event Manager and Tickets Selling Plugin for WooCommerce < 3.8.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. 1. Add an event in the plugin with a city meta as: " onmouseover="alert1" 2. On a n...

WordPress My Tickets Plugin <= 1.9.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software My Tickets Type Plugin Vulnerable versions = 1.9.10 Fixed in 1.9.11 OWASP Top 10 A8: Cross Site Request Forgery CSRF Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3393f084dbba Credits WordfenceTeam Required...

ccbwroundtable.brownpapertickets.com Cross Site Scripting vulnerability OBB-3127897

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

QR Code Scam

An enterprising individual made fake parking tickets with a QR code for easy payment...

Samba 加密问题漏洞

Samba is the standard Windows interoperability program suite for Linux and Unix. A security vulnerability exists in samba versions prior to samba 4.15.13, samba versions prior to samba 4.16.8, which stems from the fact that a Samba AD DC using Heimdal can force the issuance of Kerberos tickets...

CVE-2022-45141

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption...

16,000+ Scam Domains Aimed at FIFA World Cup Fans in Qatar

By Habiba Rashid From phishing attacks to selling fake tickets, scammers have set up thousands of domains to trick FIFA World Cup 2022 fans in Qatar. This is a post from HackRead.com Read the original post: 16,000+ Scam Domains Aimed at FIFA World Cup Fans in Qatar...