CVE-2023-0894 Pickup | Delivery | Dine-in date time <= 1.0.9 - Admin+ Stored XSS

The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

WordPress plugin Pickup | Delivery | Dine-in date time 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. A cross-site...

WordPress Pickup | Delivery | Dine-in date time Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Pickup | Delivery | Dine-in date time Type Plugin Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0894 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b34002e286cc Credits Sajj...

Draw organizer can time draws so that user's have the illusion of fair random, but draw can be cancelled.

Lines of code Vulnerability details Description In RandomDraw, host can call startDraw or redraw to request a Chainlink random number, which will be used to select the winning user. They may then collect the prize NFT using winnerClaimNFT. The issue is that in the two draw functions, it is never...

GHSA-85XW-3HP5-6FMC Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event...

WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin versions = 1.0.1. Solution Update the WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin to the latest available version at least 1.0.2...

WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.3.14 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Food Store – Online Food Delivery & Pickup plugin versions = 1.3.14. Solution Update the WordPress Food Store – Online Food Delivery & Pickup plugin to the latest available version at least 1.4...

WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin versions = 1.0.1. Solution Update the WordPress Pickup & Delivery from Customer Locations for WooCommerce plugin to the latest available...

Body Found in Canada Identified as Neo-Nazi Spam King

The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of Davis Wolfgang Hawke, a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports. Homicide detectives said they...

Home Depot Confirms Data Breach in Order Confirmation SNAFU

Home Depot has exposed the private order confirmations of hundreds of Canadian consumers, containing names, physical addresses, email addresses, order details and partial credit-card information. After customers began reporting that they had received hundreds of emails from the home-improvement...

File Upload Vulnerability in Laike E-commerce Management System v3.3 of Pickup Network Technology Co.

Laike e-commerce management system can be customized multi-terminal full-scene mall, focusing on interface aesthetics and user experience. A file upload vulnerability exists in the Laikai E-commerce Management System v3.3 of Pickup Network Technology Limited, which can be exploited by attackers t...

U.S. Dept Of Defense: █████ - Pre-generation of VIEWSTATE allows CAC bypass

Summary: As of today, ███ is back online https://███████. █████████ allows users to check a box labeled Require CAC for Pick-up. This option requires users to present their CAC in order to download files. As explained by ███: Choosing this option, however, does add a significant degree of assuran...

SQL Injection Vulnerability in China Shipping Container Lines Shanghai Co.

China Shipping Container Lines Shanghai Co., Ltd. is a professional agent company integrating international and domestic container solicitation, shipping agency and container agency. China Shipping Container Electronic Picking System is a set of transportation enterprise product order system. A S...

China Shipping Container Lines (Shanghai) Co.

China Shipping e-Pickup System is a product order system for transportation companies. A design logic vulnerability exists in the China Shipping e-Pickup System of China Shipping Container Lines Shanghai Co. Ltd. that allows an attacker to exploit the vulnerability to execute commands and view...

medimax.de XSS vulnerability

Vulnerable URL: https://www.medimax.de/store-pickup/1050290/pointOfServices Details: Description| Value ---|--- Patched:| Yes, at 20.11.2015 Latest check for patch:| 20.11.2015 15:53 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 82553 Google Pagerank| 4 VIP...

LetterIt 2.0 - (inc/session.php) Remote File Include Vulnerability

漏洞软件：LetterIt 2.0 软件下载：http://sourceforge.net/projects/letterit.berlios/ 漏洞类型：RFI 远程文件包含漏洞 软件介绍： LetterIt 2.0 是一个基于WEB页面的邮件列表管理器，安装简单并且支持多国语言。它可以通过PHP Mail，sendmail，qmail，SMTP 或者pickup mode（Windows下）等多种方式发送HTML 或者 Text文本消息以及附件到指定邮件列表。 漏洞分析： 这个远程文件包含漏洞出现在LetterIt 2.0的 “inc/session.php” 文件中。 漏洞代码：...

Microsoft IIS 4.0 Pickup Directory DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1819/info An email with a filename consisting of over 86 characters and an extension of .txt.eml will cause Microsoft IIS to crash if placed in the \mailroot\pickup directory. The process inetinfo.exe will crash, resultin...

firefox security update

24.2.0-1.0.1.el64 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Build with nspr-devel = 4.10.0 to fix build failure 24.2.0-1 - Update to 24.2.0 ESR 24.1.0-4 - Fixed mozbz938730 - avoid mix of memory allocators crashes when using system sqlite 24.1.0-3 - Fixed...

CVE-2008-3345

SQL injection vulnerability in staticpages/easyecards/index.php in MyioSoft EasyE-Cards 3.5 trial edition tr and 3.10a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a pickup action...

CVE-2008-3345

SQL injection vulnerability in staticpages/easyecards/index.php in MyioSoft EasyE-Cards 3.5 trial edition tr and 3.10a, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a pickup action...