CVE-2021-25062

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25078

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests...

CVE-2021-25062

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25062 Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25062

CVE-2021-25062 affects the Orders Tracking for WooCommerce WordPress plugin prior to 1.1.10. The vulnerability stems from insufficient sanitisation/escaping of the file_url in admin-page output, enabling Reflected Cross-Site Scripting. Impact is client-side script execution within the admin conte...

WordPress plugin 跨站脚本漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the WordPress plugin Affiliates Manager prior to...

CVE-2021-25078: Improper Neutralization of Input During Web Page Generation

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests...

PT-2022-9618

Name of the Vulnerable Software and Affected Versions Orders Tracking for WooCommerce WordPress plugin versions prior to 1.1.10 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the file url is not properly sanitised and escaped before being outputted...

CVE-2021-25062: Improper Neutralization of Input During Web Page Generation

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

PT-2022-9634

Name of the Vulnerable Software and Affected Versions Affiliates Manager WordPress plugin versions prior to 2.9.0 Description The issue allows unauthenticated attackers to perform Cross-Site Scripting attacks against admin users viewing tracked requests due to the lack of validation, sanitization...

CVE-2022-0185

creationtimestamp| type| source ---|---|--- 2022-01-22 00:20:08+00:00| published-proof-of-concept| Telegram/cZHRCQIb7mVwEwPgUhRmgGXZDJpWRWiHGP56BhZb73fOTWD 2022-01-23 17:17:15+00:00| published-proof-of-concept| https://t.me/NeKaspersky/1716 2022-01-24 07:36:35+00:00| published-proof-of-concept|...

goCabrito - Super Organized And Flexible Script For Sending Phishing Campaigns

Super organized and flexible script for sending phishing campaigns. Features Sends to a single email Sends to lists of emails text Sends to lists emails with first, last name csv Supports attachments Splits emails in groups Delays sending emails between each group Support Tags to be placed and...

A week in security (January 10 – 16)

Last week on Malwarebytes Labs: Ransomware cyberattack forces New Mexico jail to lock down Some Android users can disable 2G now and why that is a good thing Phishers on the prowl with fake parking meter QR codes Update now: Microsoft patches 97 bugs including 6 zero-days and a wormable one...

New Unpatched Apple Safari Browser Bug Allows Cross-Site User Tracking

A software bug introduced in Apple Safari 15's implementation of the IndexedDB API could be abused by a malicious website to track users' online activity in the web browser and worse, even reveal their identity. The vulnerability, dubbed IndexedDB Leaks, was disclosed by fraud protection software...

CVE-2021-1037

The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it. This lets apps keep track of what devices are paired without requesting BLUETOOTH permissions.Product: AndroidVersions: Android-10 Android-11...

3rd-party flaws allowed a teen hacker to track location of Tesla cars

By ghostadmin The security researcher made a startling revelation that he could access more than 25 Tesla vehicles in around… This is a post from HackRead.com Read the original post: 3rd-party flaws allowed a teen hacker to track location of Tesla cars...

Atlassian Jira Information Disclosure Vulnerability (CNVD-2022-05436)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The Atlassian Jira Server is vulnerable to an information disclosure vulnerability that results from configuration and other errors in the operation of a networked system or product. An authenticated remote attacker c...

Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes

x86 32bits emulator, for securely emulating shellcodes. Features  rust safety, good for malware. All dependencies are in rust. zero unsafe blocks. very fast emulation much faster than unicorn 3,000,000 instructions/second 100,000 instructions/second printing every instruction -vv. powered by...

Crater Invoice Crater 代码问题漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. Crater Invoice crater suffers from a code issue vulnerability that stems from the unrestricted upload of dangerous types o...

The Facebook Pixel Hunt aims to unravel Facebook’s tracking methods. Will you join?

Browser developer Mozilla has announced a research project to provide insights into, and data about, a space that’s opaque to policymakers, researchers and users themselves. Tracking the trackers is the name of the game. Give up some of your data voluntarily to stop the involuntary collection by...