CVE-2023-28422

CVE-2023-28422 affects MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce (WordPress). Describes an authenticated (admin+) stored XSS in versions up to 3.8.6. CVSS/metrics vary: NVD lists a medium impact (C, I) with no availability impact; PatchStack notes a fix in 3.8.7 and...

PT-2023-21709 · Magepeople · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce versions 3.8.6 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This...

Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory described the issue in which Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR 102.8. Some of these bugs showed evidence of memory...

Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory described the issue in which Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR 102.8. Some of these bugs showed evidence of memory...

Team Member < 4.5 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks...

WordPress WP VR Plugin <= 8.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP VR Type Plugin Vulnerable versions = 8.2.5 Fixed in 8.2.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer WPFunnels Team PSID 93df9c4109e0 Credits István Márton Required privile...

WordPress Team Member Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)

Software Team Member Type Plugin Vulnerable versions = 4.4 Fixed in 4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23647 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 58324d90afad Credits Rio Darmawan Required privilege...

Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory described the issue in which Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR 102.8. Some of these bugs showed evidence of memory...

Malicious Package

Overview egstore-suspense is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious Package

Overview cms-ui-views is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview react-advanced-breadcrumbs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

CVE-2023-123456

creationtimestamp| type| source ---|---|--- 2023-03-08 07:21:00+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3890 2026-07-29 12:00:38+00:00| seen| https://t.me/CVEhub/10768 2026-07-30 00:01:06+00:00| seen| https://t.me/CVEhub/10768 2026-07-31 06:00:04+00:00|...

4 Things You May Not Know About Performance Analytics Technology

By Owais Sultan Managers are aware that they are being held accountable for their teams performance. How well their teams do… This is a post from HackRead.com Read the original post: 4 Things You May Not Know About Performance Analytics Technology...

Debian: Security Advisory (DLA-128-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Shein's Android App Caught Transmitting Clipboard Data to Remote Servers

An older version of Shein's Android application suffered from a bug that periodically captured and transmitted clipboard contents to a remote server. The Microsoft 365 Defender Research Team said it discovered the problem in version 7.9.2 of the app that was released on December 16, 2021. The iss...

The benefits of a customer-centric cloud security mindset

Why a customer focus unlocks new levels of innovation and enables security team success...

Cortex-XDR-Config-Extractor - Cortex XDR Config Extractor

This tool is meant to be used during Red Team Assessments and to audit the XDR Settings. With this tool its possible to parse the Database Lock Files of the Cortex XDR Agent by Palo Alto Networks and extract Agent Settings, the Hash and Salt of the Uninstall Password, as well as possible...

GHSA-7RQG-HJWC-6MJF Grafana vulnerable to Stored Cross-site Scripting in Text plugin

Description On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to...

Malicious Package

Overview yandex-sendlinksms is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview tanker-ts-i18n is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...