CVE-2023-0370

The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0370

The CVE affects the WordPress plugin WPB Advanced FAQ, versions 1.0.0 through 1.0.6. The vulnerability stems from inadequate validation and escaping of certain shortcode attributes, allowing stored XSS when the shortcode is embedded in a page/post. Impact: attackers with the contributor role or h...

CVE-2023-0370 WPB Advanced FAQ <= 1.0.6 - Contributor+ Stored XSS

The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

HookSpoofer A Novel Infostealer with Advanced Capabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary North Korea-linked hacking group Reaper has recently been observed engaging in surveillance of North Korean defectors. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...

CVE-2023-24381

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NsThemes Advanced Social Pixel plugin = 2.1.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NsThemes Advanced Social Pixel plugin = 2.1.1 versions...

CVE-2023-24381

NsThemes Advanced Social Pixel plugin for WordPress (versions

PT-2023-19542 · Nsthemes · Nsthemes Advanced Social Pixel

Name of the Vulnerable Software and Affected Versions: NsThemes Advanced Social Pixel plugin versions = 2.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For NsThemes Advanced Social Pix...

WordPress plugin WPB Advanced FAQ 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Plugin Advanced Social Pixel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

The vulnerability of the AMD KVM subsystem for supporting embedded virtualization in Linux kernel allows a hacker to induce a service failure.

The vulnerability of the AMD KVM subsystem for supporting embedded virtualization in Linux operating systems’ kernels is related to improper handling of embedded termination processes. Exploiting this vulnerability can allow attackers to cause service failures...

WP-Advanced-Search <= 3.3.8 - Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Security Bulletin: CVE-2022-2879, CVE-2022-41715, CVE-2022-2880, CVE-2022-41717, CVE-2022-41716 may affect IBM CICS TX Advanced

Summary Multiple CVEs - CVE-2022-2879, CVE-2022-41715, CVE-2022-2880, CVE-2022-41717, CVE-2022-41716 may affect IBM CICS TX Advanced . IBM CICS TX Advanced has addressed the applicable CVEs. Relevant go related packages have been upgraded. Vulnerability Details CVEID:CVE-2022-2879 DESCRIPTION:...

WordPress Advanced Product Labels for WooCommerce Plugin <= 1.2.4 is vulnerable to Broken Access Control

Software Advanced Product Labels for WooCommerce Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 306429b28772 Credits...

CVE-2023-24468

Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2...

CVE-2023-24468

Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2...

Improper access control

Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2...

CVE-2023-26084

The armv8decaesgcmfull API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable...

Tick APT Targeted High-Value Customers of East Asian Data-Loss Prevention Company

A cyberespionage actor known as Tick has been attributed with high confidence to a compromise of an East Asian data-loss prevention DLP company that caters to government and military entities. "The attackers compromised the DLP company's internal update servers to deliver malware inside the...

Malicious code in react-advanced-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43ca4841853fdec8c951bcbb886eb3fbf01574178c614c25db2ed6a608d31d45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...