0Xb9

تسمح مشكلات البرمجة النصية عبر المواقع (XSS) بحقن نصوص برمجية ضارة عبر عناوين المواضيع ومحتوى المنشورات وحقول ملف تعريف المستخدم مثل `Location` و`Bio`. بالإضافة إلى ذلك، توجد ثغرة تزوير الطلبات عبر المواقع في إجراء الملف الشخصي «timeline.php»، مما يمكّن المهاجمين من تغيير صورة الغلاف الخاصة بالمستخدم عن طريق إنشاء نماذج خبيثة يتم تنفيذها عندما يزور الضحايا الملفات الشخصية المتأثرة.

تسمح ثغرة ”رفض الخدمة“ للمهاجمين المحليين بتعطيل التطبيق عن طريق إدخال سلسلة أحرف طويلة للغاية في شريط البحث. يحدث التعطل عندما يقوم المهاجم بلصق مخزن مؤقت مكون من 2000 حرف في حقل البحث، ثم ينفذ عملية بحث، ويختار أي نتيجة.

يحتوي المكون الإضافي MyBB Delete Account على ثغرة أمنية تتعلق بـ«البرمجة النصية عبر المواقع» (cross-site scripting) في حقل إدخال سبب حذف الحساب. يمكن للمهاجم حقن نصوص برمجية ضارة يتم تنفيذها في واجهة الإدارة عند عرض أسباب حذف الحساب. يسمح الحقل المعرض للخطر بحقن نصوص برمجية تؤثر على واجهة الإدارة.

The issue is an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with admin or higher user role privileges can potentially include and execute local files on the system, which could lead to sensitive information disclosure or code execution. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher user role privileges can potentially include and execute local files on the system.

The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher role privileges can potentially include and execute local files on the server. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly escaped before being outputted back in an attribute in the admin dashboard. This can lead to malicious script execution.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly sanitised and escaped before being outputted back in an attribute in the admin dashboard.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly escaped before being outputted back in an attribute in the admin dashboard.

The issue arises from the improper sanitization of the slider import search feature and the `tab` parameter in the plugin's settings, which can lead to Reflected Cross-Site Scripting issues.

The issue allows any authenticated users, such as subscribers, to change settings due to a lack of capability and CSRF checks. This can also be exploited through CSRF if user registration is not possible. Additionally, the cookie banner setting is not properly sanitized or validated before being output on all frontend and backend pages, leading to a Stored Cross-Site Scripting issue.

The issue is related to the slider import search feature, which did not properly sanitize the `keyword` GET parameter, leading to a reflected Cross-Site Scripting issue.

The issue is related to a reflected Cross-Site Scripting problem. It occurs because the settings page of the plugin did not properly sanitise the `tab` parameter before outputting it back.

The issue is related to a reflected Cross-Site Scripting problem. The settings page of the plugin did not properly sanitise the `tab` parameter before outputting it back.

The issue is related to a reflected Cross-Site Scripting problem. It occurs because the `tab` parameter of the plugin's options page is not properly sanitized before being output in an attribute. This allows for malicious scripts to be injected.

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11.1 Description: The issue allows an attacker to perform Cross-Site Request Forgery, enabling them to make a logged-in administrator add, edit, or delete form fields. This could also lead to Stored Cross-Site Scripting issues. Recommendations: For versions prior to 5.11.1, update to version 5.11.1 or later to resolve the issue.

The issue allows an attacker to perform a Cross-Site Request Forgery, enabling them to make a logged-in administrator update arbitrary payment history. This can include changing the status of payments, for example, from pending to completed.

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11 Description: The issue allows an attacker to make a logged-in administrator import files due to a Cross-Site Request Forgery problem. Additionally, the plugin's failure to validate uploaded files could lead to Remote Code Execution (RCE). Recommendations: For versions prior to 5.11, update to version 5.11 or later to resolve the issue. As a temporary workaround, consider restricting file import functionality to minimize the risk of exploitation. Avoid using the file import feature until the issue is resolved.

The issue is related to a reflected Cross-Site Scripting problem. It occurs because the `tab` parameter of the plugin's options page is not properly sanitized before being output in an attribute. This allows for malicious scripts to be injected.

The issue allows any registered user to leave an XSS payload in the plugin settings, which can be triggered by any user visiting them. This could potentially allow for privilege escalation. The estimated number of potentially affected devices is not specified.