CVE-2013-10029 Exit Box Lite Plugin wordpress-exit-box-lite.php exitboxadmin cross-site request forgery

A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely...

CVE-2013-10029

CVE-2013-10029 concerns the WordPress plugin Exit Box Lite (up to version 1.06). The vulnerability resides in the function exitboxadmin of wordpress-exit-box-lite.php, enabling cross-site request forgery (CSRF) that can be triggered remotely. A patch is available: upgrading to version 1.10 addres...

PT-2023-10017 · WordPress · Exit Box Lite Plugin

Name of the Vulnerable Software and Affected Versions: Exit Box Lite Plugin versions up to 1.06 Description: A problematic issue has been found in the Exit Box Lite Plugin, affecting some unknown functionality of the file wordpress-exit-box-lite.php. This issue leads to information disclosure and...

WordPress Plugin Exit Box Lite 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-10016 · WordPress · Exit Box Lite Plugin

Name of the Vulnerable Software and Affected Versions: Exit Box Lite Plugin versions up to 1.06 Description: A problematic vulnerability was found in the Exit Box Lite Plugin, affecting the exitboxadmin function of the wordpress-exit-box-lite.php file. This vulnerability leads to cross-site reque...

WordPress Plugin Exit Box Lite 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

WooCommerce Box Office < 1.1.52 - Unauthenticated Ticket Barcode Update

The plugin does not have authorisation and CSRF when updating a ticket bar-code, allowing unauthenticated users to perform such action PoC curl https://example.com/wp-admin/admin-ajax.php -d "action=saveticketbarcodebarcodeimage=xxxbarcodetext=xxxxxid=86"...

WooCommerce Box Office < 1.1.52 - Unauthenticated Ticket Barcode Update

The plugin does not have authorisation and CSRF when updating a ticket bar-code, allowing unauthenticated users to perform such action curl https://example.com/wp-admin/admin-ajax.php -d "action=saveticketbarcode&ticketbarcodeimage=xxx&ticketbarcodetext=xxxxx&ticketid=86"...

WordPress GDPR Cookie Consent Notice Box Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software GDPR Cookie Consent Notice Box Type Plugin Vulnerable versions = 1.1.6 Fixed in 1.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32294 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e4ea913f3b06 Credits Emili...

WordPress WooCommerce Box Office Plugin <= 1.1.51 is vulnerable to Broken Access Control

Software WooCommerce Box Office Type Plugin Vulnerable versions = 1.1.51 Fixed in 1.1.52 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-34003 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 51c5f4c853cf Credits Rafie Muhammad...

WooCommerce Box Office < 1.1.51 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks tickets columns='111"...

WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Box Office Type Plugin Vulnerable versions = 1.1.50 Fixed in 1.1.51 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34004 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 270c72521204 Credits Rafie Muhammad...

WooCommerce Box Office < 1.1.51 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC tickets columns='111"...

Docker Desktop 代码注入漏洞

Docker Desktop is a container technology-based desktop software for lightweight deployment of applications from the U.S. company Docker. The product provides a desktop environment that supports creating a container lightweight virtual machine and deploying and running applications on...

May 23, 2023—KB5026436 (OS Build 22000.2003) Preview

None None...

May 23, 2023—KB5026435 (OS Build 19045.3031) Preview

None None...

KeePass Exploit Allows Attackers to Recover Master Passwords from Memory

A proof-of-concept PoC has been made available for a security flaw impacting the KeePass password manager that could be exploited to recover a victim's master password in cleartext under specific circumstances. The issue, tracked as CVE-2023-32784, impacts KeePass versions 2.x for Windows, Linux,...

UBUNTU-CVE-2023-31623

An issue in the mpboxcopy component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

Virtuoso Open-Source Edition SQL注入漏洞

Virtuoso Open-Source Edition is a high-performance and scalable multi-model RDBMS, data integration middleware, linked data deployment, and HTTP application server platform open-sourced by OpenLink Software. A security vulnerability exists in Virtuoso Open-Source Edition version v7.2.9, which ste...

CVE-2023-0544

The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...