45 matches found
CVE-2023-0065
The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0065 i2 Pros & Cons <= 1.3.1 - Contributor+ Stored XSS
The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0065
CVE-2023-0065 concerns the i2 Pros & Cons WordPress plugin (versions
CVE-2023-0065: Improper Neutralization of Input During Web Page Generation
The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WordPress i2 Pros & Cons Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)
Software i2 Pros & Cons Type Plugin Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0065 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID cc85825abe76 Credits Lana Codes Required...
i2 Pros & Cons <= 1.3.1 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. i2prosandcons showbutton='true'...
clearwaterplumbingpros.com Cross Site Scripting vulnerability OBB-2969880
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Simple Yet Vital Crypto Security Tips for Beginners and Pros
By Owais Sultan Cryptocurrency is taking over the world – but you need to be safe when using it. Right now,… This is a post from HackRead.com Read the original post: Simple Yet Vital Crypto Security Tips for Beginners and Pros...
How to Buy Precious Patching Time as Log4j Exploits Fly
Sure, Apache got a patch out fast when the Log4j logging library vulnerability – aka Javageddon or “up there with Shellshock” – exploded last week. But emergency patches take days best-case scenario or weeks to install: plenty of time for attackers to do their worst. Which they lickety-split did,...
Manage Open Source Software Library Risks
Learn about the growing open source library trend, the pros and cons of using open source code, and how to mitigate associated risks...
What is a honeypot? How they are used in cybersecurity
Cybersecurity experts strive to enhance the security and privacy of computer systems. Quietly observing threat actors in action can help them understand what they have to defend against. A honeypot is one such tool that enables security professionals to catch bad actors in the act and gather data...
Silver Sparrow malware on 30,000 Macs leaves security pros confused
By Habiba Rashid According to researchers, as of mid-February, Silver Sparrow malware has affected almost 30,000 macOS across 153 countries. This is a post from HackRead.com Read the original post: Silver Sparrow malware on 30,000 Macs leaves security pros confused...
mortgagefirmpros.com Cross Site Scripting vulnerability OBB-1300346
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
bennettlawncarepros.com Cross Site Scripting vulnerability OBB-1209141
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
vExpert Security 2020 Award Announcement
Thank you to everyone who applied for the vExpert Security sub-group and thank you to the vExpert PRO’s for doing their part in this process. We are pleased to announce the list of 2020 vExperts Security. Each of these vExperts have demonstrated significant contributions to the community and a...
Celebrate Cybersecurity Awareness Month with These Tips From a Survey of 1,200 Security Pros
Held every October, National Cybersecurity Awareness Month NCSAM is a collaborative effort between government and industry meant to raise awareness about the importance of cybersecurity. NCSAM is focused largely on consumer awareness, but for cybersecurity leaders, it is also a great opportunity ...
A DoorDash Breach Exposes Data of 4.9 Million Customers
A NotPetya lawsuit, bricked Mac Pros, and more of the week's top security news...
Exploring the Top 15 Most Common Vulnerabilities with HackerOne and GitHub
Join vulnerability experts Michiel Prins, cofounder of HackerOne, and Greg Ose, GitHub’s application security engineering manager, as Threatpost editor Tom Spring moderates a discussion on the 15 most common vulnerability types. Registration Required Originally presented in March 2019, this webin...
Help Keep Data and Systems Safe with Access Rights Manager (ARM)
Built to provision, deprovision, audit, and manage user access rights to data, files, and other systems, SolarWinds® Access Rights Manager ARM is designed to help security admins and IT pros protect their companies from potential risks like data loss and breaches. Visualize who has access to what...
A week in security (May 20 – 26)
Last week on Malwarebytes Labs, we took a look at a skimmer pretending to be a payment service provider, gave an overview of what riskware is, took a deep dive into concerns about PACS leaks, and dug around in the land of “These Governments said fix it…hurry up”. Other cybersecurity news Changes...