3767 matches found
PT-2023-28520 · WordPress · Min Max Control
Name of the Vulnerable Software and Affected Versions: Min Max Control WordPress plugin versions prior to 4.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...
WordPress plugin Min Max Control cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...
CVE-2023-4270: Undefined Security Weakness
The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2023-2802)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mirai Botnet Variant 'Pandora' Hijacks Android TVs for Cyberattacks
A Mirai botnet variant called Pandora has been observed infiltrating inexpensive Android-based TV sets and TV boxes and using them as part of a botnet to perform distributed denial-of-service DDoS attacks. Doctor Web said the compromises are likely to occur either during malicious firmware update...
PT-2024-14728
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an implicit overflow on virtio max dma size in the Linux kernel. Specifically, there is an implicit conversion from size t to u32 in the code: u32max size = size...
max-machinery.com Cross Site Scripting vulnerability OBB-3638192
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
max-gurtsystem.de Cross Site Scripting vulnerability OBB-3638145
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress Min Max Control Plugin < 4.6 is vulnerable to Cross Site Scripting (XSS)
Software Min Max Control Type Plugin Vulnerable versions 4.6 Fixed in 4.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4270 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f355d50b63c9 Credits Animesh Gaurav Required...
M-10 Unmitigated
Lines of code Vulnerability details Issue not mitigated About the problem There was unsafe cast in the getTier function and warden has stated, that in case if value will be bigger than uint96.max, then wrong prize amount will be used. Solution Pool together has increased Tier.prizeSize variable t...
Min Max Control < 4.6 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. alert1'...
PT-2025-40685
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vdpa nl policy structure, used for validating netlink attributes nlattr during message parsing, lacked a necessary check for the maximum virtual queue pair VQP attribute. This missin...
Rocky Linux 9 : bind (RLSA-2023:4099)
The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:4099 advisory. - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to...
Re-entrancy in flash minting USDO can bypass max checks
Lines of code Vulnerability details Impact function flashLoan IERC3156FlashBorrower receiver, address token, uint256 amount, bytes calldata data external override notPaused returns bool // @audit re-enter and mint requiretoken == addressthis, "USDO: token not valid"; requiremaxFlashLoantoken =...
ARCDVestingVault._syncVotingPower could revert if newVotingPower is big enough.
Lines of code Vulnerability details Impact ARCDVestingVault.syncVotingPower calculate the change in voting power using int256newVotingPower - int256grant.latestVotingPower. If newVotingPower is greater than typeint256.max, ARCDVestingVault.syncVotingPower could revert. Proof of Concept...
User able to steal all votes escrowed in LockingVault due to downcasting
Lines of code Vulnerability details Even though the LockingVault is considered out of scope, it contains very serious vulnerability allowing anyone to steal ALL Arcade voting tokens. The vulnerability is possible due to downcasting amount to withdraw to uint96. In case that the amount of tokens...
Amazon Linux AMI : bind (ALAS-2023-1789)
The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.90. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1789 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished...
Important: bind
Issue Overview: A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to exceed significantly...
