WordPress WooCommerce Plugin < 6.6.0 Stored HTML Injection Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2022-2099

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles...

Design/Logic Flaw

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles...

CVE-2022-2099 WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles...

CVE-2022-2099

CVE-2022-2099 affects the WooCommerce WordPress plugin prior to 6.6.0. The issue is a stored HTML injection vulnerability caused by insufficient escaping/sanitizing in the payment gateway titles, enabling injection into stored content. Impact is limited to sites running WooCommerce versions befor...

CVE-2022-2099 WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles...

PT-2022-14857 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce WordPress plugin versions prior to 6.6.0 Description: The issue is related to stored HTML injection due to a lack of escaping and sanitizing in the payment gateway titles. This allows for potential malicious code injection...

Liquidator cut is calculated incorrectly

Lines of code Vulnerability details Impact User can call payBase function to pay debt in return for collateral. But due to incorrect calculation User will obtain lesser collateral than what he should actually receive causing immediate permanent loss Proof of Concept 1. User calls payBase function...

WordPress plugin WooCommerce 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

User can set auctioneer to address(0) to prevent vault from being liquidated

Lines of code Vulnerability details Impact Vault cannot be liquidated Proof of Concept auction can be called with any address as the 'to' address. A majority of ERC20 tokens will revert if a transfer is initiated to address0, notably, including USDC. Since the auctioneer is paid each time a payme...

Microsoft Warns of Large-Scale AiTM Phishing Attacks Against Over 10,000 Organizations

Microsoft on Tuesday disclosed that a large-scale phishing campaign targeted over 10,000 organizations since September 2021 by hijacking Office 365's authentication process even on accounts secured with multi-factor authentication MFA. "The attackers then used the stolen credentials and session...

Project Owner can mint all tokens to their own address

Lines of code Vulnerability details Impact A project owner may mint all tokens for the project in JBController.mintTokensOf , with all tokens minted by the project owner to their own address, the payer during any pay call would be unable to to mint any project token as the mint function would...

Short position owner will loose funds when put option expired

Lines of code Vulnerability details Impact Fees are expected to be paid whenever an option is exercised as per the function comment on L235. However, the current protocol implementation also charges fees for expired put options. The owner of a short put option is subject to paying fees whenever t...

A Guide to Surviving a Ransomware Attack

Surviving ransomware is possible with a combination of preparation and intentionality. Often, there is a misguided characterization of ransomware attacks that implies defenders either completely thwart an attack or that attackers establish complete control of their targets’ IT infrastructure. But...

Zibal 安全漏洞

Zibal is the Zibal payment gateway. A security vulnerability exists in Zibal. An attacker could exploit the vulnerability to access sensitive user information and digital currency keys, as well as elevated privileges...

Malicious code in zalopay-payment-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f2446418ad41cf8aea6d5900977109ccc23b832966a0c1d481fadf1e6f63720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7374 Malicious code in zalopay-payment-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f2446418ad41cf8aea6d5900977109ccc23b832966a0c1d481fadf1e6f63720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in guest-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ce1cff0935b74e6c78fb7c631345ff63909f30095a79fe559ae55d0182e8c35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3495 Malicious code in guest-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ce1cff0935b74e6c78fb7c631345ff63909f30095a79fe559ae55d0182e8c35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dazaar-payment-lightning (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7226941fe2ffff561836755d642ba46fd05042203afb41780113b47705fd0062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...