15626 matches found
CVE-2023-36383
Summary: CVE-2023-36383 concerns a Stored Cross-Site Scripting (XSS) in the MagePeople MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce, version <= 3.9.5, exploitable by authenticated users with editor privileges. Affected components: WordPress plugin “Event Manager for...
CVE-2023-36383 WordPress Event Manager for WooCommerce Plugin <= 3.9.5 is vulnerable to Cross Site Scripting (XSS)
Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin = 3.9.5 versions...
FIN8 Group Using Modified Sardonic Backdoor for BlackCat Ransomware Attacks
The financially motivated threat actor known as FIN8 has been observed using a "revamped" version of a backdoor called Sardonic to deliver the BlackCat ransomware. According to the Symantec Threat Hunter Team, part of Broadcom, the development is an attempt on the part of the e-crime group to...
PT-2023-3698 · Oracle · Oracle Application Express Team Calendar Plugin
Name of the Vulnerable Software and Affected Versions: Oracle Application Express Team Calendar Plugin versions 18.2 through 22.1 Description: The issue is related to insufficient input validation in the Application Express Team Calendar Plugin component of Oracle Application Express. This easily...
PT-2023-25564 · Magepeople · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce
Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin versions = 3.9.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with editor or higher...
WordPress a-staff – Team member showcase plugin for WordPress Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software a-staff – Team member showcase plugin for WordPress Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0b68c5a40cb8 Credit...
Oracle Application Express 安全漏洞
Oracle Application Express is a low-code development platform from Oracle Corporation. A security vulnerability exists in the Application Express Team Calendar Plugin product for Oracle Application Express, which arises from a vulnerability in the User Account module that allows a low-privileged...
WordPress Ant Admin Notices for Team Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)
Software Ant Admin Notices for Team Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2410afb1f6ab Credits Rafie Muhammad Patchsta...
WordPress Team Members â Best WordPress Team Plugin with Live Team Builder Plugin < 2.8.3 is vulnerable to Cross Site Scripting (XSS)
Software Team Members â Best WordPress Team Plugin with Live Team Builder Type Plugin Vulnerable versions 2.8.3 Fixed in 2.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...
CVE-2023-3584 Member can create team with team override scheme
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme...
CVE-2023-3584 Member can create team with team override scheme
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme...
CVE-2023-3584
Mattermost CVE-2023-3584 affects the POST /api/v4/teams endpoint. The root cause is improper authorization checks when a team override scheme ID is supplied, enabling an authenticated attacker who knows a valid Team Override Scheme ID to create a new team using that scheme. Documents consistently...
VX-API - Collection Of Various Malicious Functionality To Aid In Malware Development
The VX-API is a collection of malicious functionality to aid in malware development. It is recommended you clone and/or download this entire repo then open the Visual Studio solution file to easily explore functionality and concepts. Some functions may be dependent on other functions present with...
PT-2023-25337 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from a failure to properly check authorization for the "POST /api/v4/teams" endpoint when a team override scheme ID is passed in the request. This allows an authenticate...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick
It is an exploit module targeting Apache Log4j. The target produ...
SEO Expert Hired and Fired By Ashley Madison Turned on Company, Promising Revenge
This is Part II of a story published here last week on reporting that went into a new Hulu documentary series on the 2015 Ashley Madison hack. It was around 9 p.m. on Sunday, July 19, when I received a message through the contact form on KrebsOnSecurity.com that the marital infidelity website...
A Bootiful Podcast: Spring Framework and Spring Boot legend Stéphane Nicoll on a Bootiful Podcast
Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! In this installment, Josh Long talk to Spring team legend Stéphane Nicoll @snicoll about Spring Boot, Apache Maven and Gradle, his journey to the Spring team, and so much more. This episode was recorded live from beautiful...
ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor
Problem It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. Solution Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin. Credits @sypets for reporting this finding to the TYPO3...
GHSA-Q9W4-W667-QQJ4 ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor
Problem It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. Solution Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin. Credits @sypets for reporting this finding to the TYPO3...
