205 matches found
CVE-2021-24593 Business Hours Indicator < 2.3.5 - Authenticated Stored XSS
The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue...
CVE-2021-24593
CVE-2021-24593 affects the WordPress plugin Business Hours Indicator prior to version 2.3.5. The vulnerability is an Authenticated Stored Cross-Site Scripting (XSS) caused by the plugin not sanitising or escaping the 'Now closed message' setting in both backend and frontend outputs. Impact is sto...
WordPress 插件跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Business Hours Indicator prior t...
Business Hours Indicator < 2.3.5 - Authenticated Stored XSS
The plugin does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue Put the following payload in the "Now closed message" setting and save them: alert/XSS/ Then refresh the setting...
WordPress Business Hours Indicator plugin <= 2.3.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Business Hours Indicator plugin versions = 2.3.4. Solution Update the WordPress Business Hours Indicator plugin to the latest available version at least 2.3.5...
Business Hours Indicator < 2.3.5 - Authenticated Stored XSS
The plugin does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue PoC Put the following payload in the "Now closed message" setting and save them: Then refresh the setting page, or ...
Streaming Numbers Jump for European Football Tournament Delivered by Akamai
The video streaming traffic that Akamai delivered for more than 30 rights-holding customers during the July 11 Italy-England football soccer final as part of the delayed-to-2021European soccer tournament peaked at 34.9 Tbps on the Akamai edge platform. The traffic peak during the final match was...
CISOs Struggle to Cope with Mounting Job Stress
The CISOs aren’t OK. A new survey showed the pandemic has ratcheted up job pressure to “extreme stress” levels among chief information security officers CISOs, and it’s left them grappling for coping mechanisms ranging from workouts to narcotics. OneLogin released the results of its survey of 250...
WordPress code issue vulnerability (CNVD-2021-44308)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in Business Hours Pro WordPress plugin version 5.5.0 and prior...
CVE-2021-24240
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability...
CVE-2021-24240
CVE-2021-24240 affects the WordPress plugin Business Hours Pro (versions ≤ 5.5.0). The issue arises from the plugin’s manual update function, allowing an unauthenticated attacker to upload arbitrary files, which can lead to unauthenticated remote code execution (RCE). The exploitation path and im...
WordPress 代码问题漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in Business Hours Pro WordPress plugin version 5.5.0 and prior...
Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE
The plugin allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability. Note WPScanTeam: - The issue has been escalated to Envato on March 30th, 2021 and the plugin has been removed from the...
WordPress Business Hours Pro plugin <= 5.5.0 - Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)
Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Harald Eilertsen in WordPress Business Hours Pro plugin versions = 5.5.0. Solution No patched version is available. Deactivate and delete...
VulnCheck KEV: CVE-2021-24240
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability...
CVE-2021-27188
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service access suspended for five hours by making five invalid login attempts to a victim's account...
CVE-2021-27188
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service access suspended for five hours by making five invalid login attempts to a victim's account...
Rocket.Chat: Unauthenticated clients can modify Livechat Business Hours
The Meteor method "livechat:saveOfficeHours" allowed unauthenticated clients to modify the global Livechat Business Hours by directly updating the database model...
Become a White Hat Hacker — Get 10 Top-Rated Courses at 97% OFF
Many of us here would love to turn hacking into a full-time career. To make that dream come true, you need to master your subject and earn some key certifications. To speed up this process, you might want to take a little guidance from the experts. Featuring 98 hours of content from top...