1345 matches found
kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition
Description The plugin does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition. PoC 1- Install and activate kk Star Ratings. 2- Go to the page that displays the star rating. 3- Using Burp and the Turbo Intruder extension, intercept the rating...
star-sports.de Improper Access Control vulnerability OBB-3771476
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection
Description The plugin unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog. PoC Run the below command in the developer console of the web browser while being on the blog...
WordPress kk Star Ratings Plugin <= 5.4.5 is vulnerable to Broken Access Control
Software kk Star Ratings Type Plugin Vulnerable versions = 5.4.5 Fixed in 5.4.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46639 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f81ae2f458b9 Credits Revan Arifio Required privile...
Fedora 38 : fwupd (2023-48c43df788)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-48c43df788 advisory. This release adds the following features: Add a launchd agent for macOS Add a new security attribute for BIOS capsule updates to be enabled Add functionality...
chile.5-sterne-hotel-weltweit.de Cross Site Scripting vulnerability OBB-3698210
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
hollywoodstarplasticsurgery.com Cross Site Scripting vulnerability OBB-3614896
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
SUSE CVE-2023-32005
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API. As a result...
CVE-2023-34017
Unauth. Reflected Cross-Site Scripting XSS vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin = 2.6.7 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin = 2.6.7 versions...
CVE-2023-34017 WordPress Five Star Restaurant Reservations Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin = 2.6.7 versions...
WordPress Plugin Five Star Restaurant Reservations 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-24634 · Unknown · Five Star Restaurant Reservations
Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Reservations plugin versions = 2.6.7 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...
WordPress Five-Star Ratings Shortcode Plugin < 1.2.48 is vulnerable to Cross Site Scripting (XSS)
Software Five-Star Ratings Shortcode Type Plugin Vulnerable versions 1.2.48 Fixed in 1.2.48 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ed6e5abc9527 Credits Rafie Muhammad...
WordPress kk Star Ratings Plugin < 5.4.5 is vulnerable to Cross Site Scripting (XSS)
Software kk Star Ratings Type Plugin Vulnerable versions 5.4.5 Fixed in 5.4.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a02b4b22ea39 Credits Rafie Muhammad Patchstack Required...
WordPress Five Star Restaurant Menu Plugin <= 2.4.6 is vulnerable to Cross Site Request Forgery (CSRF)
Software Five Star Restaurant Menu Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-37985 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 865c6a248f59 Credits Ellio...
WordPress kk Star Ratings Plugin <= 5.4.3 is vulnerable to Broken Access Control
Software kk Star Ratings Type Plugin Vulnerable versions = 5.4.3 Fixed in 5.4.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36528 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ef1dd884760d Credits Mika Required privilege...
PT-2023-9687 · Node.Js · Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A flaw in the experimental permission model of Node.js version 20 allows malicious actors to retrieve stats from files they do not have explicit read access to when the --allow-fs-read flag is used with a non-...
SUSE CVE-2023-30582
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a...
