307 matches found
CVE-2020-12054
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter a search query. Also affected are 16 themes if the plugin is enabled by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise...
CVE-2020-12054
CVE-2020-12054 affects the WordPress Catch Breadcrumb plugin prior to 1.5.4 and is a reflected XSS via the s parameter (search query). The vulnerability also extends to 16 themes from the same author when the plugin is enabled (Alchemist, Izabel, Chique, Clean Enterprise, Bold Photography, Intuit...
Catch Breadcrumb < 1.5.7 - Unauthenticated Reflected XSS
=== DESCRIPTION - REFLECTED XSS ======================================== Catch Breadcrumb 1.5.4 plugin for WordPress allow Reflected XSS via a search query when used with one of the theme from the same author: Alchemist & Alchemist PRO, Izabel & Izabel PRO, Chique & Chique PRO, Clean Enterprise &...
Catch Breadcrumb < 1.5.7 - Unauthenticated Reflected XSS
=== DESCRIPTION - REFLECTED XSS ======================================== Catch Breadcrumb 1.5.4 plugin for WordPress allow Reflected XSS via a search query when used with one of the theme from the same author: Alchemist & Alchemist PRO, Izabel & Izabel PRO, Chique & Chique PRO, Clean Enterprise &...
WordPress Catch Breadcrumb plugin <= 1.5.6 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress Catch Breadcrumb plugin versions = 1.5.6. Solution Update the WordPress Catch Breadcrumb plugin to the latest available version at least 1.5.7...
PoS Malware Exposes Customer Data of Catch Restaurants
Popular NYC restaurants Catch NYC, Catch Roof and Catch Steak discovered and removed malware on their point-of-sale PoS systems — but not before it exposed credit-card information from unknowing diners. Catch Hospitality Group, which owns the three NYC hotspots, said in a data-breach notice this...
RUSTSEC-2019-0038 Fix for UB in failure to catch panics crossing FFI boundaries
Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB. This flaw was corrected by this commit1 which was included in version 2.6.0. 1: https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494...
Fix for UB in failure to catch panics crossing FFI boundaries
Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which is a form of UB. This flaw was corrected by this commit1 which was included in version 2.6.0. 1: https://github.com/jnqnfe/pulse-binding-rust/commit/7fd282aef7787577c385aed88cb25d004b85f494...
WAVM Buffer Over-Read Vulnerability
WAVM is the WebAssembly Virtual Machine. A heap buffer over-read vulnerability exists in IR::FunctionValidationContext::catchall in WAVM 2018-07-26 and earlier versions, which can be exploited by an attacker to cause a denial of service application crash by sending a specially crafted file...
await vs return vs return await
When writing async functions, there are differences between await vs return vs return await, and picking the right one is important. Let's start with this async function: async function waitAndMaybeReject // Wait one second await new Promiser = setTimeoutr, 1000; // Toss a coin const isHeads =...
await vs return vs return await
When writing async functions, there are differences between await vs return vs return await, and picking the right one is important. Let's start with this async function: async function waitAndMaybeReject // Wait one second await new Promiser = setTimeoutr, 1000; // Toss a coin const isHeads =...
Sky Catchers App has an overstepping access vulnerability
Daily Catch App is an O2O crane catching software. Daily Catch App has an over-the-horizon access vulnerability that allows an attacker to log into the system and obtain sensitive information by catching packets and modifying IDs...
VHostScan - Virtual Host Scanner
A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. First presented at SecTalks BNE in September 2017 slidedeck. Key Benefits Quickly highlight unique content in catch-all scenarios Locate the outliers in catch-all scenarios whe...
HTTP Virtual Host Scanner: VHostScan
A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. First presented at SecTalks BNE in September 2017 Key Benefits Quickly highlight unique content in catch-all scenarios Locate the outliers in catch-all scenarios where results...
Microsoft Edge Chakra Parser::ParseCatch Failed eval Handle
Microsoft Edge: Chakra: Parser::ParseCatch doesn't handle "eval" CVE-2017-11764 In Javascript, the code executed by a direct call to eval shares the caller block's scopes. Chakra handles this from the parser. And there's a bug when it parses "eval" in a catch statement's param. ParseNodePtr...
polarkoru.fi XSS vulnerability
Vulnerable URL: http://www.polarkoru.fi/itemdetail.php?n=PKR-20335=Fresh Water Pearl Bracelet. Toggle catch 925 Sterling Silver.=item/20110425231349/www.PolarKoru 20335.jpg"';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 21.11.2017 Vulnerability type:| XSS...
python-oslo-middleware: CatchErrors leaks sensitive values into error logs
An information-disclosure flaw was found in oslo.middleware. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs for example, keystone tokens...
python-oslo-middleware: CatchErrors leaks sensitive values into error logs
An information-disclosure flaw was found in oslo.middleware. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs for example, keystone tokens...
hfs2. 3X remote code execution exploit-vulnerability warning-the black bar safety net
hfs 2.3 X many catch the chicken hackers like to use it to spread the Trojan, but the last in a tick look to this software broke a remote code execution vulnerability No CVE2014-6 2 8 7） The blogger looked after very interested in so you try to play a bit ! 2 0 1 6 0 3 2 8 1 1 3 3 3 0 First on...
Miku,FreeMp3♬GROOVE CATCH S.E - Dangerous filesystem permissions, WebView SSL handling enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Miku,FreeMp3♬GROOVE CATCH S.E published at the 'play' market has multiple vulnerabilities...