CVE-2023-23722 WordPress WP eBay Product Feeds Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Winwar Media WP eBay Product Feeds plugin = 3.3.1 versions...

CVE-2023-23722

CVE-2023-23722 affects the WordPress WP eBay Product Feeds plugin up to version 3.3.1. The flaw is an admin+ Stored XSS due to insufficient sanitisation/escaping of settings, exploitable by high-privilege administrators (requires user interaction). PatchStack and WPVulnDB confirm a fix in version...

WordPress Plugin WP eBay Product Feeds 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Rebuild 跨站脚本漏洞

Rebuild is a highly customizable enterprise management system. A security vulnerability exists in Rebuild 3.2.3 and earlier versions, which stems from a problem with the file /feeds/post/publish and can lead to cross-site scripting...

CVE-2023-1613: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in Rebuild up to 3.2.3 and classified as problematic. This vulnerability affects unknown code of the file /feeds/post/publish. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

PT-2023-19161

Name of the Vulnerable Software and Affected Versions Winwar Media WP eBay Product Feeds plugin versions 3.3.1 and earlier Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations For Winwar Media WP...

CVE-2023-23722: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Winwar Media WP eBay Product Feeds plugin = 3.3.1 versions...

CVE-2023-28434

creationtimestamp| type| source ---|---|--- 2023-03-22 23:35:58+00:00| seen| https://t.me/cibsecurity/60516 2023-03-23 14:52:47+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4016 2023-03-23 15:55:52+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4018 2023-03-27...

CVE-2023-27532

creationtimestamp| type| source ---|---|--- 2023-03-10 07:02:05+00:00| seen| https://t.me/ctinow/98243 2023-03-10 14:00:08+00:00| seen| https://t.me/truesecator/4153 2023-03-13 09:03:22+00:00| seen| https://t.me/kasperskyb2b/511 2023-03-23 13:49:43+00:00| published-proof-of-concept|...

CVE-2022-41328

creationtimestamp| type| source ---|---|--- 2023-03-07 20:23:36+00:00| seen| https://t.me/cibsecurity/59597 2023-03-08 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=983 2023-03-14 07:05:01+00:00| exploited| https://t.me/thehackernews/3145 2023-03-14 12:25:07+00:00|...

Price manipulation attack

Lines of code Vulnerability details Impact The PriceFeed.sol was marked OOS but I believe this to be a valid issue. If the chainlink feed fails which is does from time to time, the Tellor price feed takes over no matter what the delta is compared to the chainlink price. This is an issue because t...

CVE-2022-39948

An improper certificate validation vulnerability CWE-295 in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a...

Splunk Enterprise 8.1 < 8.1.13, 8.2.0 < 8.2.10 (SVD-2023-0201)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0201 advisory. - In Splunk Enterprise versions below 8.1.13 and 8.2.10, the createrss' external search command overwrites existing Resource...

Lack of certificate verification when establishing secure connections with threat feed fabric connectors

...

SUSE CVE-2007-2026

The gnu regular expression code in file 4.20 allows context-dependent attackers to cause a denial of service CPU consumption via a crafted document with a large number of line feed characters, which is not well handled by OS/2 REXX regular expressions that use wildcards, as originally reported fo...

SUSE CVE-2008-4698

Opera before 9.61 does not properly block scripts during preview of a news feed, which allows remote attackers to create arbitrary new feed subscriptions and read the contents of arbitrary feeds...

SUSE CVE-2009-3265

Cross-site scripting XSS vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design...

SUSE CVE-2012-0479

Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid 1 RSS or 2 Atom XML content...

SUSE CVE-2016-6189

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the 1 ics or 2 XML calendar feeds...

SUSE CVE-2016-20011

libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync...