CVE-2021-24607

The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed...

CVE-2021-24607

The CVE concerns the WordPress Storefront Footer Text plugin (versions Customize) and payloads, indicating frontend and admin areas can be affected. Remediation/action: deactivate and delete the plugin, as PatchStack notes the plugin is closed for review since 2021-10-06. No explicit exploit sta...

CVE-2021-24607 Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site Scripting

The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Storefront Footer Text plugin in version 1.0.1 an...

Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

Citrix StoreFront Server contains an XML External Entity XXE processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information...

HTTP 301 StoreFront URL Redirect not working for Citrix Workspace App for Windows 21.05 or newer

When attempting to redirect your On-Prem StoreFront URL to your new Cloud Workspace URL, It works successfully when you use the Web Browser as the URL correctly redirects to your new URL. - But you encounter issues with Citrix Workspace App not redirecting to the new URL...

Shopify: After changing the storefront password, the preview link is still valid

Description: 1. The user needs to know the storefront password to generate the preview link. 2. After the administrator changes the storefront password, users can still access the storefront through the preview link. 3.reason: （1）User can generate preview link. （2）Simply changing the password wil...

WordPress Storefront Footer Text plugin <= 1.0.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Storefront Footer Text plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of October 6, 2021 and is not available for download. This closure is temporary, pending a full...

Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed. PoC The plugin requires the Storefront theme Go to Appearance Customize...

Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed. The plugin requires the Storefront theme Go to Appearance Customize /wp-admin/customize.ph...

Shopify: Bypass a fix for report #708013

Summary: customerAccessTokenCreate mutation in the Storefront API does not correctly throttle login attempts. An issue in similar report https://hackerone.com/reports/708013 was already fixed, however, there is still a bypass. Steps To Reproduce: 1. Grab a Storefront API Token I got it from the B...

When access the storefront webpage getting .Net errors

When access the newly added Storefront server getting the below error. Error : The 'targetFramework' attribute in the element of the Web.config file is used only to target version 4.0 and later of the .NET Framework for example, ''. The 'targetFramework' attribute currently references a version...

Unable to add Store in Native Workspace/Receiver App from External Machines

On adding Store error "Your account cannot be added" or "Could not detect the specific account" appears On Storefront no errors in event viewer Wireshark trace on NetScaler shows, NetScaler senta request to Storefront server for "/Agservices/Discover", storefront server returns "500 : Internal...

"KeyboardLayout=(Server Default)" cannot take effect on Citrix Workspace app for Linux

Use the following way to change the Keyboard Layout sync mode to Server Default. Configure in StoreFront File Path:C:\inetpub\wwwroot\Citrix%StoreName%\AppData\default.ica Change setting inWFClient:KeyboardLayout=Server Default Or configure in CWA for Linux File path:/.ICAClient/wfclient.ini...

How to Customize App Shortcuts with Receiver for Windows

As a Receiver administrator, you can configure Receiver for Windows 4.2.100 to automatically place application and desktop shortcuts directly in the Start menu or on the desktop in a similar way that Receiver for Windows 3.4 Enterprise places them. The new shortcut only mode provides a seamless...

StoreFront 1912 LTSR - Unable to add favorites

Cannot add app. Getting error when adding the apps/desktop to favorites...

Enable RSA SecurID Authentication for DFA in Storefront

How to Enable RSA SecurID Authentication for DFA in storefront server...

Unable to open the StoreFront console, error “MMC has detected an error in a snap-in and will unload it”

• The customer is unable to open the StoreFront Store console in one StoreFront SF server • When opening the console, he gets the option to view stores or create new stores • If clicking on Server group on the left menu, he can see the member servers with no problems • When clicking ‘View Stores’...

Storefront page displayed in Dutch instead of English

In certain conditions, the StoreFront web page may be displayed in a language other than English. In this instance, we are using Dutch as an example but this applies to any language...

CVE-2021-33666

When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation...