CVE-2023-25466 WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin = 1.4.14.3 versions...

CVE-2023-25466

CVE-2023-25466 applies to the WordPress plugin Mahlamusa Who Hit The Page – Hit Counter, affected versions ≤ 1.4.14.3. Reported as unauthenticated, reflected Cross-Site Scripting (XSS). Remediation guidance from PT-2023-20084 indicates upgrading to a version higher than 1.4.14.3 (or disabling the...

CVE-2023-3356

The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping...

CVE-2023-34173

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alexander Semikashev Yandex Metrica Counter plugin = 1.4.3 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alexander Semikashev Yandex Metrica Counter plugin = 1.4.3 versions...

Cross site scripting

The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping...

CVE-2023-3356 Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS

The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping...

CVE-2023-3356

CVE-2023-3356 affects the Subscribers Text Counter WordPress plugin (pre-1.7.1). The issue is a CSRF vulnerability that allows an authenticated attacker (logged-in admin) to update plugin settings without proper CSRF protection, which can lead to Stored XSS due to insufficient sanitisation/escapi...

CVE-2023-34173 WordPress Yandex Metrica Counter Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alexander Semikashev Yandex Metrica Counter plugin = 1.4.3 versions...

CVE-2023-34173

CVE-2023-34173 affects the WordPress Yandex Metrica Counter plugin 1.4.3 or mitigate access to the plugin’s admin interface. Several entries note the vulnerability status as unpatched/unconfirmed patches while recommending upgrading to a newer version where available. The CVE is publicly documen...

WordPress plugin counter-yandex-metrica 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Subscribers Text Counter 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-24711 · Yandex · Alexander Semikashev Yandex Metrica Counter

Name of the Vulnerable Software and Affected Versions: Alexander Semikashev Yandex Metrica Counter plugin versions = 1.4.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Alexander Semikashev Yandex Metrica Counter plugin. This vulnerability...

PT-2023-24385 · WordPress · Subscribers Text Counter

Name of the Vulnerable Software and Affected Versions: Subscribers Text Counter WordPress plugin versions prior to 1.7.1 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This...

Exploit for Incorrect Calculation in Google Android

CVE-2020-0022 Many thanks to Insinuator for their amazing blo...

USN-6307-1 cjose vulnerability

It was discovered that JOSE for C/C++ AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. An attacker could use this to cause a denial of service system crash or might expose sensitive information...

[Important] [Security] Virtuozzo ReadyKernel Patch 159.0 for Virtuozzo Hybrid Server 7.5

The cumulative Virtuozzo ReadyKernel patch was updated with security fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.5. Vulnerability id: CVE-2023-3268 3.10.0-1160.41.1.vz7.183.5 to 3.10.0-1160.80.1.vz7.191.4 Out-of-bound memory access during reading relayfs...

SUSE-SU-2023:3329-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' bsc1206418. - CVE-2023-0459: Fixed information leak in uaccessbeginnospec...

OESA-2023-1467 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping PoC Create an HTML file with the...