Wordpress EventON Calendar 4.4 Plugin - Unauthenticated Event Access Vulnerability

Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access Exploit Author: Miguel Santareno Vendor Homepage: https://www.myeventon.com/ Version: 4.4 Tested on: Google and Firefox latest version CVE : CVE-2023-2796 1. Description The plugin lacks authentication and...

Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access

Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access Date: 03.08.2023 Exploit Author: Miguel Santareno Vendor Homepage: https://www.myeventon.com/ Version: 4.4 Tested on: Google and Firefox latest version CVE : CVE-2023-2796 1. Description The plugin lacks...

A Penetration Testing Buyer's Guide for IT Security Teams

The frequency and complexity of cyber threats are constantly evolving. At the same time, organizations are now collecting sensitive data that, if compromised, could result in severe financial and reputational damage. According to Cybersecurity Ventures, the cost of cybercrime is predicted to hit ...

PHPJabbers Availability Booking Calendar 5.0 Cross Site Scripting

Exploit Title: PHPJabbers Availability Booking Calendar 5.0 - Reflected XSS Exploit Author: CraCkEr Date: 20/07/2023 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/availability-booking-calendar/ Tested on: Windows 10 Pro Impact: Manipulat...

Malicious code in auto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d5eebeeaf5ef87c0a419e6e3716aa1a1046926c3d90905b645d03a46be860b0 The OpenSSF Package Analysis project identified 'auto-assign-team-action' @ 2000.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1117 Malicious code in auto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d5eebeeaf5ef87c0a419e6e3716aa1a1046926c3d90905b645d03a46be860b0 The OpenSSF Package Analysis project identified 'auto-assign-team-action' @ 2000.0.0 npm as malicious. It is considered malicious because: - The...

CISA Known Exploited Vulnerability Catalog July 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...

CVE-2023-34869

PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /index.php?controller=pjAdmin&action=pjActionForgot...

CVE-2023-34869

PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /index.php?controller=pjAdmin&action=pjActionForgot...

MAL-2023-1037 Malicious code in hsisu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c986ceb6d450b915124305a19037997afedd7936b69467f557d17afd7182d27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1035 Malicious code in flot-axis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75e800a2dadaa8f5d0ac8a5db1564e97a702c66176c2da0c537191d88cf8fc81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PHPJabbers Time Slots Booking Calendar Cross Site Scripting Vulnerability

PHPJabbers Time Slots Booking Calendar is a booking system from PHPJabbers. A cross-site scripting vulnerability exists in PHPJabbers Time Slots Booking Calendar v3.3, which stems from a cross-site scripting XSS vulnerability contained in the component...

CVE-2023-34869

PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /index.php?controller=pjAdmin&action=pjActionForgot...

MAL-2023-1026 Malicious code in fca-tpk05-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68a464386cec91304cf1a2a774e200123d42ae944a6f03bb1b8c272c6d6b85e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1022 Malicious code in stitch-fix-men (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eac11d5514b7620fd60ea61fd8b8421be1caf4eedb0eab7204cb09cf9d48c43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1017 Malicious code in ory-hydra-mock-oauth2-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65a839721d0fab0dc481a43bb9cf463966ebf8badc1ed1a9beebdc0724262a94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1013 Malicious code in fca-pogi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 319ad862ef0f37f8e4f8fb8124f86bc9a402ea9701bf931a7bee5e20bb60b3a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Lack of Preventing Multiple Follows to the Same Profile ID

Lines of code Vulnerability details Impact The absence of a check for multiple follows to the same profile ID poses a significant security and integrity risk for the smart contract. By exploiting this vulnerability, a malicious user could inflate the number of followers for a particular profile I...

CVE-2023-3977

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for...

CVE-2023-3977

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handleinstallation function that is called via the inisevinstallation AJAX aciton in various versions. This makes it possible for...