WordPress Plugin Team Circle Image Slider With Lightbox 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-20442 · WordPress · Team Circle Image Slider With Lightbox

Name of the Vulnerable Software and Affected Versions: The Team Circle Image Slider With Lightbox plugin for WordPress versions up to, and including, 1.0.17 Description: The issue is related to Reflected Cross-Site Scripting via the search term parameter due to insufficient input sanitization and...

CVE-2023-2604: Improper Neutralization of Input During Web Page Generation

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘searchterm’ parameter in versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

WordPress Circle Progress 1.0 Cross Site Scripting

Exploit Title: WordPress Plugin Circle progress bar – Cross site scripting-Stored Date: 2-06-2023 Exploit Author: Taliya Bilal- NightHawk Vendor Homepage: https://wordpress.org/plugins/circle-progress-bar/ Version: 1.0 Tested on: Firefox Contact me: [email protected] Steps to reproduce: 1...

WordPress Bubble Menu – circle floating menu Plugin <= 3.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Bubble Menu – circle floating menu Type Plugin Vulnerable versions = 3.0.3 Fixed in 3.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2362 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 5c8ff648baff Credits Erw...

CVE-2022-27646: Stack-based Buffer Overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2023-23984

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Bubble Menu – circle floating menu plugin = 3.0.1 leading to form deletion...

CVE-2023-23984 WordPress Bubble Menu – circle floating menu Plugin <= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Bubble Menu – circle floating menu plugin = 3.0.1 leading to form deletion...

CVE-2023-23984: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Bubble Menu – circle floating menu plugin = 3.0.1 leading to form deletion...

Bubble Menu - Circle Floating Menu < 3.0.2 - Form Deletion via CSRF

The plugin does not have CSRF checks when deleting forms, which could allow attackers to make logged in users perform such actions via a CSRF attack...

circlecityheattreating.com Cross Site Scripting vulnerability OBB-2969243

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

X (Formerly Twitter): Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpoint

An attacker was able to view private Twitter Circle posts by liking them through the /FavoriteTweet endpoint and then downloading their Twitter data archive, which contained the full content of the liked posts...

MAL-2022-1904 Malicious code in circle-admin-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f76a2bc0c0f563c74e8f1cf6ead555272deba5738524e1f4ee893708391de3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in circle-admin-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f76a2bc0c0f563c74e8f1cf6ead555272deba5738524e1f4ee893708391de3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerabilities fixed in FreeRADIUS

Two vulnerabilities have been fixed in FreeRADIUS. The vulnerabilities allow a malicious party to cause a denial-of-service or to obtain sensitive data obtain. To cause the denial-of-service, the malicious party must possess a system in the FreeRADIUS "circle of trust." The developers of FreeRADI...

(Pwn2Own) NETGEAR R6700v3 Missing Authentication for Critical Function Arbitrary File Upload Vulnerability

This vulnerability allows network-adjacent attackers to upload arbitrary files on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Circle Parental Control feature, which listens on TCP ports 4444 a...

CVE-2022-0648

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the orderpos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0648

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the orderpos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Team Circle Image Slider With Lightbox...

CVE-2022-0648: Improper Neutralization of Input During Web Page Generation

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the orderpos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...