in VeAssetDepositor and Booster contract don't set safeApprove() to 0 first and that token uses OpenZeppelin’s ERC20 implementation

Lines of code Vulnerability details Impact OpenZeppelin’s implementation of safeApprove won't work if approved amount is not set to 0. so the logics will fail if code don't set it 0 first. Both VeToken and VE3Token use OpenZeppelin’s ERC20 implementation and VeAssetDepositor and Booster calls...

WordPress Mobile Booster plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Mobile Booster plugin versions = 1.2. Solution Update the WordPress Mobile Booster plugin to the latest available version at least 1.2.1...

WordPress "WordPress Robots.txt optimization (+ XML Sitemap) – Website traffic, SEO & ranking Booster" plugin < 1.4.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress Robots.txt optimization + XML Sitemap – Website traffic, SEO & ranking Booster" plugin versions 1.4.4. Solution Update the WordPress "WordPress Robots.txt optimization + XML Sitemap – Websit...

WordPress SEO Booster plugin < 3.8.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SEO Booster plugin versions 3.8.5. Solution Update the WordPress SEO Booster plugin to the latest available version at least 3.8.5...

WordPress SEO Booster plugin < 3.8.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SEO Booster plugin versions 3.8.5. Solution Update the WordPress SEO Booster plugin to the latest available version at least 3.8.5...

WordPress Mobile Booster plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Mobile Booster plugin versions = 1.2. Solution Update the WordPress Mobile Booster plugin to the latest available version at least 1.2.1...

WordPress Asset CleanUp: Page Speed Booster plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. Asset CleanUp:Page Speed Booster WordPress plugin prior to version 1.3.8.5 is vulnerable to a cross-site scripting vulnerability, which stems from the fact that the wpacuselectedsub tabarea parameter is...

WordPress Asset CleanUp: Page Speed Booster plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language.Asset CleanUp:Page Speed Booster WordPress plugin in versions prior to 1.3.8.5 has a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and outpu...

WordPress Asset CleanUp: Page Speed Booster Plugin < 1.3.8.5 Multiple XSS Vulnerabilities

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-24937

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacuselectedsubtabarea parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24937

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacuselectedsubtabarea parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue...

Cross site scripting

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacuselectedsubtabarea parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24937

The CVE-2021-24937 entry concerns the WordPress plugin Asset CleanUp: Page Speed Booster prior to version 1.3.8.5. The root cause is improper escaping of the wpacu_selected_sub_tab_area parameter in admin-page output, enabling a Reflected Cross-Site Scripting (XSS) vulnerability. Multiple sources...

WordPress plugin跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language.Asset CleanUp:Page Speed Booster WordPress plugin in versions prior to 1.3.8.5 has a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and outpu...

WordPress plugin 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. Asset CleanUp:Page Speed Booster WordPress plugin prior to version 1.3.8.5 is vulnerable to a cross-site scripting vulnerability, which stems from the fact that the wpacuselectedsub tabarea parameter is...

CVE-2021-24983: Improper Neutralization of Input During Web Page Generation

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanupfetchactivepluginsicons AJAX action available to admin users, leading to a Reflected Cross-Site Scripting issue...

PT-2022-9517

Name of the Vulnerable Software and Affected Versions The Asset CleanUp: Page Speed Booster WordPress plugin versions prior to 1.3.8.5 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the wpacu selected sub tab area parameter is not properly escaped...

PT-2022-9546

Name of the Vulnerable Software and Affected Versions The Asset CleanUp: Page Speed Booster WordPress plugin versions prior to 1.3.8.5 Description The issue arises from the plugin's failure to sanitise and escape posted parameters sent to the "wpassetcleanup fetch active plugins icons" AJAX actio...

CVE-2021-24937: Improper Neutralization of Input During Web Page Generation

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacuselectedsubtabarea parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue...

WordPress SQL Injection Vulnerability (CNVD-2022-03213)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blogging sites on servers with PHP and MySQL.The WordPress plugin Speed Booster Pack version 4.3.3.1 previously had a SQL injection...