Schedule recovery DOS by front-running with original schedule recovery transaction if no other transaction is executed

Lines of code Vulnerability details Description If after scheduling a recovery no transaction is executed, anyone can DOS the execution of this scheduled recovery by a signature replay attack given that the nonce is not increased Impact DOS of scheduled recovery execution if after a recovery is...

CVE-2021-4364

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearchaddjobimportschedulecall function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls...

CVE-2021-4364

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearchaddjobimportschedulecall function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls...

CVE-2021-4364

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearchaddjobimportschedulecall function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls...

PT-2023-12475 · WordPress · Jobsearch Wp Job Board

Name of the Vulnerable Software and Affected Versions: JobSearch WP Job Board plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to a missing capability check on the jobsearch add job import schedule call function, allowing authenticated attackers to bypas...

CVE-2023-3035

A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attac...

Cross site scripting

A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attac...

CVE-2023-3035 Guangdong Pythagorean OA Office System Schedule cross site scripting

A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attac...

Guangdong Pythagorean OA Office System 跨站脚本漏洞

Guangdong Pythagorean OA Office System Gougu OA is a practical enterprise office system open source China Gouguopen gouguopen. A cross-site scripting vulnerability exists in Guangdong Pythagorean OA Office System versions prior to 4.50.31. The vulnerability stems from an unknown function in the...

PT-2023-22646 · Unknown · Guangdong Pythagorean Oa Office System

Name of the Vulnerable Software and Affected Versions: Guangdong Pythagorean OA Office System versions up to 4.50.31 Description: A vulnerability has been found in the Schedule Handler component, where the manipulation of the description argument leads to cross-site scripting. This issue can be...

CVE-2023-3035: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attac...

scheduleitonline.com Cross Site Scripting vulnerability OBB-3355783

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kernel: bpf: Add schedule points in batch ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Add schedule points in batch ops syzbot reported various soft lockups caused by bpf batch operations. INFO: task kworker/1:1:27 blocked for more than 140 seconds. INFO: task hung in rcubarrier Nothing prevents batch ops to...

kernel: net/sched: fix netdevice reference leaks in attach_default_qdiscs()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix netdevice reference leaks in attachdefaultqdiscs In attachdefaultqdiscs, if a dev has multiple queues and queue 0 fails to attach qdisc because there is no memory in attachonedefaultqdisc. Then dev-qdisc will be...

PT-2025-8305

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock issue in the Linux kernel has been identified in the device attach function. The problem arises when the async schedule dev function is called within the device lock, leading ...

CVE-2023-30860

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...

CVE-2023-30860 WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...

CVE-2023-30860 WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...

CVE-2023-26519

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alex Benfica Publish to Schedule plugin = 4.5.4 versions...

CVE-2023-26519 WordPress Publish to Schedule Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alex Benfica Publish to Schedule plugin = 4.5.4 versions...