Pablo Sanchez

Nome do Software Vulnerável e Versões Afetadas: Cisco BroadWorks Application Delivery Platform (versões afetadas não especificadas) Descrição: Uma vulnerabilidade na interface de gerenciamento baseada na web pode permitir que um atacante remoto autenticado realize ataques de cross-site scripting (XSS) contra um usuário da interface. Isso ocorre devido à validação insuficiente de entradas fornecidas pelo usuário pela interface de gerenciamento baseada na web de um sistema afetado. Um atacante pode explorar essa vulnerabilidade injetando código malicioso em páginas específicas da interface, potencialmente executando código de script arbitrário no contexto da interface afetada ou acessando informações sensíveis baseadas no navegador. O atacante precisa possuir credenciais administrativas válidas para explorar essa vulnerabilidade. Recomendações: Atualmente, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Booking Calendar WordPress plugin versions prior to 9.7.3.1 **Description** The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators due to the plugin's failure to sanitize and escape some of its booking form data. **Recommendations** For versions prior to 9.7.3.1, update to version 9.7.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the booking form to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The WordPress Online Booking and Scheduling Plugin versions prior to 22.4 **Description** The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited by high privilege users such as admin. **Recommendations** For versions prior to 22.4, update to version 22.4 or later to resolve the issue. As a temporary workaround, consider restricting access to high privilege users until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Translate WordPress with GTranslate WordPress plugin versions prior to 3.0.4 **Description** The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This is possible even when the unfiltered html capability is disallowed, for example, in a multisite setup. The vulnerability affects multiple parameters. **Recommendations** For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings for high-privilege users until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal versions prior to 2.0.6 **Description** The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitised and escaped before being used in a SQL statement. This allows unauthenticated users to exploit the site. **Recommendations** For versions prior to 2.0.6, update to version 2.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin until the update is applied.

**Name of the Vulnerable Software and Affected Versions** WP EasyPay WordPress plugin versions prior to 4.1 **Description** The issue is related to Reflected Cross-Site Scripting, where some generated URLs are not properly escaped before being outputted back in pages. This could be used against high-privilege users, such as admins. **Recommendations** For versions prior to 4.1, update to version 4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive pages or disabling potentially vulnerable features until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Quick Paypal Payments WordPress plugin versions prior to 5.7.26.4 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example, in a multisite setup. **Recommendations** For versions prior to 5.7.26.4, update to version 5.7.26.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MyCryptoCheckout WordPress plugin versions prior to 2.124 **Description** The issue is related to Reflected Cross-Site Scripting. It occurs because some URLs are not properly escaped before being outputted in attributes. **Recommendations** For versions prior to 2.124, update to version 2.124 or later to resolve the issue.