next-call.eu Cross Site Scripting vulnerability OBB-3530109

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress WooCommerce Next Order Coupon Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Next Order Coupon Type Plugin Vulnerable versions = 0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fdbd4e47b569 Credits Rafie Muhammad...

CVE-2023-35340

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability...

Microsoft Defender for Endpoint is ranked number one in market share in the IDC Worldwide Corporate Endpoint Security Market Shares report, 2022

Microsoft security researchers tracked a 130.4 percent increase in organizations that have encountered ransomware over the last year. Endpoints are an important attack vector and ensuring that organizations have modern endpoint security as part of a broader extended detection and response strateg...

Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled

...

Malicious code in next-with-frontegg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 251ac37afbe61350facc80a00faa97821168ad425857f580f6fa33910fbd78eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-24672 · Unknown · Contiki-Ng

Name of the Vulnerable Software and Affected Versions: Contiki-NG versions prior to 4.9 Description: The issue arises when the Contiki-NG OS processes ICMP DAO packets in the dao input storing function without verifying that the packet buffer is sufficiently large, leading to potential...

Three tips for building your CISO career in today’s evolving security industry

CISOs share how to build effective, collaborative teams and land your next role...

Malicious code in theme-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7162ab25878f8f496bd39b46209cf74bee0f29b34253a0f1cca5d6a48ba830bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-881 Malicious code in theme-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7162ab25878f8f496bd39b46209cf74bee0f29b34253a0f1cca5d6a48ba830bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-34103 Stored XSS (Cross Site Scripting) in html content based fields of avo

Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting XSS when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are...

K000134706: Python IDNA vulnerability CVE-2022-45061

Security Advisory Description An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of...

webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling()

A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely...

CVE-2023-27919

Authentication bypass vulnerability in NEXT ENGINE Integration Plugin for EC-CUBE 2.0 series all versions allows a remote unauthenticated attacker to alter the information stored in the system...

PT-2023-21418 · Ec Cube · Next Engine Integration Plugin

Name of the Vulnerable Software and Affected Versions: NEXT ENGINE Integration Plugin for EC-CUBE 2.0 series all versions Description: The issue allows a remote unauthenticated attacker to alter the information stored in the system due to an authentication bypass vulnerability. Recommendations: F...

Intel NUC Pro Software Suite 安全漏洞

Intel NUC Pro Software Suite is an application from Intel Corporation USA. A security vulnerability exists in Intel NUC Pro Software Suite versions prior to 2.0.0.3, which stems from the presence of improper access control that could allow an authenticated user to potentially enable privilege...

CVE-2023-27919

Authentication bypass vulnerability in NEXT ENGINE Integration Plugin for EC-CUBE 2.0 series all versions allows a remote unauthenticated attacker to alter the information stored in the system...

CVE-2023-27919

CVE-2023-27919 describes an authentication bypass in the NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) , affecting all versions. The vulnerability allows a remote unauthenticated attacker to alter information stored in the system. The provided documents do not include a published fix or...

CVE-2023-27919

Authentication bypass vulnerability in NEXT ENGINE Integration Plugin for EC-CUBE 2.0 series all versions allows a remote unauthenticated attacker to alter the information stored in the system...

kernel: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()

In the Linux kernel, the following vulnerability has been resolved: clocksource: hyper-v: unexport init-annotated hvinitclocksource EXPORTSYMBOL and init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated init. The...