CVE-2022-4706

The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against...

CVE-2022-4706

CVE-2022-4706 affects the Genesis Columns Advanced WordPress plugin prior to 2.0.4. The issue arises from inadequate validation/escaping of shortcode attributes before output, allowing a low-privilege user (Contributor) to perform Stored XSS that could affect admins. Exploitation details are illu...

CVE-2022-4706 Genesis Columns Advanced < 2.0.4 - Contributor+ Stored XSS via Shortcode

The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against...

CVE-2022-4706 Genesis Columns Advanced < 2.0.4 - Contributor+ Stored XSS via Shortcode

The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against...

CVE-2022-4706: Undefined Security Weakness

The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against...

PT-2023-15147 · WordPress · Genesis Columns Advanced

Name of the Vulnerable Software and Affected Versions: Genesis Columns Advanced WordPress plugin versions prior to 2.0.4 Description: The issue allows users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as...

WordPress Plugin The Genesis Columns Advanced – Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Genesis Columns Advanced < 2.0.4 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins. 1. Insert t...

WordPress Genesis Columns Advanced Plugin < 2.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Genesis Columns Advanced Type Plugin Vulnerable versions 2.0.4 Fixed in 2.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4706 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID f94799f31fa9 Credits István Márt...

SiriusXM Vulnerability Lets Hackers Remotely Unlock and Start Connected Cars

Cybersecurity researchers have discovered a security vulnerability that exposes cars from Honda, Nissan, Infiniti, and Acura to remote attacks through a connected vehicle service provided by SiriusXM. The issue could be exploited to unlock, start, locate, and honk any car in an unauthorized manne...

genesisconference.co.uk Cross Site Scripting vulnerability OBB-3064411

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

avpsgenesis.ro Cross Site Scripting vulnerability OBB-2983736

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ICONICS Suite Password Storage Issue

The vulnerability of the software tools for monitoring and managing the ICONICS Suite, GENESIS64, Hyper Historian, Energy AnalytiX, and MobileHMI processes lies in the storage of passwords in an unencrypted form. Exploiting this vulnerability can allow a perpetrator to disclose the protected...

ICONICS Suite Monitoring Process Management Software Incomplete Blacklist Authentication Bypass

The vulnerabilities of the monitoring and process management software suites ICONICS Suite, GENESIS64, Hyper Historian, Energy AnalytiX, and MobileHMI are related to the use of an incomplete blacklist. Exploiting these vulnerabilities allows a malicious actor to bypass authentication procedures o...

CVE-2022-33319

Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite...

CVE-2022-33315

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions...

Mitsubishi Electric GENESIS64 and Mitsubishi Electric ICONICS Suite: Path traversal vulnerabilities

ICONICS GENESIS64 is a suite of advanced HMI SCADA solutions designed for Microsoft operating systems from ICONICS, Inc. A path traversal vulnerability exists in ICONICS GENESIS64 versions 10.97 and 10.97.1, which allows a remote, unauthenticated attacker to access arbitrary files in the GENESIS6...

MAL-2022-3338 Malicious code in genshin-impact-free-primogems-and-genesis-crystals-2022 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78b9bb1aa84bd97eb53afedfa2d56c798dbccf7ed85c213eb7b8fbff56f77d25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in genesis-volatility-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de72162b89a3c685450fe536adfed95a79252af6bf2041b4fd46caa60c58b97a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3336 Malicious code in genesis-volatility-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de72162b89a3c685450fe536adfed95a79252af6bf2041b4fd46caa60c58b97a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...