WordPress WooCommerce Quick Reports plugin <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by ThreatPress Security Research Team in WordPress WooCommerce Quick Reports plugin versions = 1.0.7. Solution 11 June 2018 - we were unable to find an updated version or its changelog...

WordPress MULTIDOTS WooCommerce Quick Reports Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. MULTIDOTS WooCommerce Quick Reports plugin is used in one of the e-commerce order report generation plugin...

WordPress WooCommerce Quick Reports plugin <= 1.0.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by ThreatPress Research Team in WordPress WooCommerce Quick Reports plugin versions = 1.0.6. Solution 3 June 2018 - plugin still closed by WordPress Security team, no patched version available...

CVE-2018-11485

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...

CVE-2018-11485

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...

CVE-2018-11485

The CVE-2018-11485 entry concerns the WordPress plugin MULTIDOTS WooCommerce Quick Reports (versions

CVE-2018-11485: Improper Neutralization of Input During Web Page Generation

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...

PT-2018-10602

Name of the Vulnerable Software and Affected Versions MULTIDOTS WooCommerce Quick Reports plugin versions 1.0.6 and earlier Description The issue allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page through a Stored XSS attack. This is possible by modifyin...

CVE-2018-11562

CVE-2018-11562 affects MISP 2.4.91 via a vulnerability in the template file app/View/Elements/eventattribute.ctp that allows reflected XSS when a user clicks a malicious link in an event view and then uses the deleted attributes quick filter. Root cause: improper handling in that view leading to ...

CVE-2018-11562: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter...

PT-2018-10670

Name of the Vulnerable Software and Affected Versions MISP version 2.4.91 Description A reflected XSS issue was discovered, allowing exploitation if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. This occurs due to a vulnerability in th...

QEMU: i386: multiboot OOB access while loading kernel image

Quick Emulator QEMU, compiled with the PC System Emulator with multiboot feature support, is vulnerable to an OOB r/w memory access issue. The issue could occur while loading a kernel image during the guest boot, if mhloadendaddr address is greater than the mhbssendaddr address. A user or process...

SCADAS "BAS920 & ISC2000" Credentials Exposed(CVE-2017-17974)

Exploit; SCADAS "BAS920 & ISC2000"; Credentials Exposed BA System “Improper Access Control Authorization” Exploit Title: "SCADAS "BAS920 & ISC2000"; Credentials Exposed” CVE: CVE-2017-17974 Date: 29/12/2017 Exploit Author: Fernandez Ezequiel @capitanalfa && Bertin Jose @bertinjoseb Vendor: BA...

Multiple Apple Products Quick Look Competitive Conditions Vulnerability

Apple iOS, macOS High Sierra, tvOS, and watchOS are products of Apple Inc. Apple iOS is an operating system for mobile devices; macOS High Sierra is a specialized operating system for Mac computers; tvOS is a smart TV operating system; and watchOS is a smart watch operating system. tvOS is a smar...

QEMU: Slirp: use-after-free when sending response

A use-after-free issue was found in the Slirp networking implementation of the Quick emulator QEMU. It occurs when a Socket referenced from multiple packets is freed while responding to a message. A user/process could use this flaw to crash the QEMU process on the host resulting in denial of...

qemu: DoS via large option request

The Network Block Device NBD server in Quick Emulator QEMU, is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other...

Moderate: Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 Newton, Red Hat OpenStack Platform 11.0 Ocata, Red Hat OpenStack Platform 12.0 Pike, Red Hat OpenStack Platform 8.0 Liberty, and Red Hat OpenStack Platform 9.0 Mitaka. Red Hat Product Security has rated this update a...

qemu: DoS via large option request

The Network Block Device NBD server in Quick Emulator QEMU, is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other...

QEMU: Slirp: use-after-free when sending response

A use-after-free issue was found in the Slirp networking implementation of the Quick emulator QEMU. It occurs when a Socket referenced from multiple packets is freed while responding to a message. A user/process could use this flaw to crash the QEMU process on the host resulting in denial of...

Cross site scripting

The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of quick filters...