CVE-2023-0157 All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSS

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user admin+ to plant bogus log files containing malicious JavaScript code that will be executed in the context of any...

CVE-2023-0156 All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

CVE-2023-0156 All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

PT-2023-16046 · WordPress · All-In-One Security

Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.5 Description: The issue allows an authorized user with admin+ privileges to plant bogus log files containing malicious JavaScript code. This code will be executed in the context...

WordPress plugin All-In-One Security路径遍历漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin of the WordPress Foundation. A path traversal vulnerability exists i...

WordPress plugin All-In-One Security 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-16045 · WordPress · All-In-One Security

Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.5 Description: The issue allows an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server, to which the web server has access...

WordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

Software Cryptocurrency All-in-One Type Plugin Vulnerable versions = 3.0.19 Fixed in N/A OWASP Top 10 A1: Injection Classification Cross Site Scripting XSS CVE CVE-2023-29435 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 156297bb9c33 Credits Mika Required privilege...

all-search.biz Cross Site Scripting vulnerability OBB-3241324

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress WP All Import v3.6.7 - Remote Code Execution Exploit

Exploit Title: WP All Import v3.6.7 - Remote Code Execution RCE Authenticated Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://www.wpallimport.com/ Software Link: https://wordpress.org/plugins/wp-all-import/advanced/ scroll down to select the version Version: =...

Malicious Package

Overview intstripesfra is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Upgraded Q -> 2 from #215 [1679863647530]

Judge has assessed an item in Issue 215 as 2 risk. The relevant finding follows: NC1 --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2023-20955

In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and uninstall applications for all users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

PT-2023-17743 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: In the onPrepareOptionsMenu method of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and uninstall applications for all users due to a missing...

Medium: rust

Issue Overview: Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, making it available to the Rust projects it builds. To reco rd when an extraction is successful, Cargo writes "ok" to the...

CVE-2023-0937

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

Cross site scripting

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2023-0937

The CVE-2023-0937 entry concerns the VK All in One Expansion Unit WordPress plugin prior to 9.87.1.0. The root cause is failure to escape the $_SERVER[REQUEST_URI] value before echoing it into an attribute, enabling Reflected Cross-Site Scripting. Affected component is the WordPress plugin code h...