Classified Listing < 3.0.5 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account

Description The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtclupdateuseraccount' function. This makes it...

JobSearch WP Job Board < 2.3.4 - Authentication Bypass

Description The plugin does not prevent attackers from logging-in as any users with the only knowledge of that user's email address. PoC Browse to the site, paste the following in your browser's console replace the email address with that site's administrator's email address:...

Security Advisory 0029

Security Advisory 0029 PDF Date: May 15th, 2017 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | May 15th, 2017 | Initial release Affected Platforms: All EOS platforms Affected Software Version: All EOS releases prior to 4.18.1F. The list of affected releases is documented in Table-2. The...