CVE-2022-44586: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS in Ayoub Media AM-HiLi plugin = 1.0 on WordPress...

PT-2022-27258 · Ayoub Media · Am-Hili

Name of the Vulnerable Software and Affected Versions: Ayoub Media AM-HiLi plugin version 1.0 and earlier Description: The issue is related to an authenticated Stored Cross-Site Scripting XSS in the Ayoub Media AM-HiLi plugin on WordPress. This means that an attacker with admin or higher privileg...

WordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Hoang Van Hiep Patchstack Alliance in the WordPress AM-HiLi plugin versions = 1.0. Solution No patched version is available...

am-distributors.com Cross Site Scripting vulnerability OBB-2902891

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

am-bits.com Cross Site Scripting vulnerability OBB-2902889

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-37953

An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST v07.09.15 and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantl...

CVE-2022-37953 WorkstationST - Response Splitting in AM Gateway Challenge-Response

An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST v07.09.15 and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantl...

CVE-2022-37953

CVE-2022-37953 affects General Electric WorkstationST prior to 07.09.15, with an HTTP response splitting vulnerability in the AM Gateway Challenge-Response dialog. The root cause is improper handling of CRLF sequences in HTTP headers, which could allow an attacker to compromise a victim’s browser...

CVE-2022-37953: Improper Neutralization of CRLF Sequences in HTTP Headers

An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST...

CVE-2022-37953

An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST...

am-so.fr Cross Site Scripting vulnerability OBB-2838415

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 36 Update: golang-github-oneofone-xxhash-1.2.8-6.fc36

This is a native Go implementation of the excellent xxhash algorithm, an extremely fast non-cryptographic Hash algorithm, working at speeds close to R AM limits...

aerztehaus-am-park.de Cross Site Scripting vulnerability OBB-2782479

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

schule-am-hexbachtal.de Cross Site Scripting vulnerability OBB-2717508

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Plugin Weblizar 8.9 - Backdoor

Exploit Title: WordPress Plugin Weblizar 8.9 - Backdoor Google Dork: 'wp-json/am-member/license' Exploit Author: Sobhan Mahmoodi Vendor Homepage: https://weblizar.com/plugins/school-management/ Version: 8.9 Tested on: windows/linux Vulnerable code: addaction 'restapiinit', function...

GHSA-PX3R-27QC-HX5G NT auth module vulnerability in OpenAM

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...

Malicious Package

Overview epic-am-ui is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview epic-am-observer-store is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview epic-am-types is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview epic-am-constants is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...