Page 4 - Cross Site Scripting News Today

Govt issues alert after 'hacktivist' groups threaten to launch attack on 15 August Representational Image. Photo: Collected. Representational Image. Photo...

Tittle:WordPress Plugin WP Brutal AI < 2.06 - Admin+ Stored XSSReferences:CVE-2023-2606Author:Taurus Omar Description:The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).Affects Plugins:WP Brutal AI - Fixed

Tittle:WordPress Plugin Login Rebuilder < 2.8.1 - Admin+ Stored XSSReferences:CVE-2023-2223Author:Taurus Omar Description:The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).Affects Plugins:Login Rebuilder - Fixed in version

Tittle:WordPress Plugin Tablesome < 1.0.9 - Reflected XSSReferences:CVE-2023-1890Author:Taurus Omar Description:The plugin does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site ScriptingAffects Plugins:Tablesome - Fixed in version 1.0.9Proof of Concept:Make a logged in admin open one of the URL below when the feature/tracking notice has

Ultimate flexibility

Zimbra the email and collaboration software brand owned by Synacor, has disclosed a cross site scripting (XSS) vulnerability in its Zimbra Collaboration Suite.

Looking for the latest Government Contracting News? Check out our story: Government's Move to Serverless: Rethinking Security Strategy. Click to read the full

Between 2011 and 2020, over $15.6 billion was stolen in crypto exchange hacks, affecting over 50 platforms, according to a Crystal Blockchain and

Advisory: Pydio Cells: Cross-Site Scripting via File DownloadPydio Cells implements the download of files using presigned URLs whichare generated using the Amazon AWS SDK for JavaScript [1]. The secretsused to sign these URLs are hardcoded and exposed through the JavaScriptfiles of the web application. Therefore, it is possible to generatevalid signatures for arbitrary download URLs.

Up to 1.5 million sites may be vulnerable to XSS attacks, according to researchers at a WordPress security firm.