Important: Red Hat Bug Fix Advisory: MTV 2.5.6 Images

Updated Release packages that fix several bugs and add various enhancements are now available. Migration Toolkit for Virtualization 2.5.6 Images...

PT-2024-18861 · WordPress · Wpkoi Templates For Elementor

Name of the Vulnerable Software and Affected Versions: WPKoi Templates for Elementor plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the Advanced Heading widget due to insufficient input sanitization and output escapin...

CVE-2023-25715

Missing Authorization vulnerability in GamiPress GamiPress – The 1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The 1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6...

Authorization

Missing Authorization vulnerability in GamiPress GamiPress – The 1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The 1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6...

WordPress plugin GamiPress security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2023-20268 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions through 2.5.6 Description: The issue is related to a Missing Authorization vulnerability in the GamiPress plugin for WordPress, which is used for gamification purposes such as rewarding points, achievements, badges, and...

WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control

Software Participants Database Type Plugin Vulnerable versions = 2.5.5 Fixed in 2.5.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48751 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 4e4f72b6b27f Credits Yudistira Arya...

PYSEC-2023-139

Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle MITM attack. Attackers with...

CVE-2023-38686 Sydent does not verify email server certificates

Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle MITM attack. Attackers with...

CVE-2023-38686 Sydent does not verify email server certificates

Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle MITM attack. Attackers with...

PT-2023-26550 · Sydent · Sydent

Name of the Vulnerable Software and Affected Versions: Sydent versions prior to 2.5.6 Description: Sydent is an identity server for the Matrix communications protocol. If configured to send emails using TLS, Sydent does not verify SMTP servers' certificates, making its emails vulnerable to...

WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce GoCardless Gateway Type Plugin Vulnerable versions = 2.5.6 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-37871 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 5a7891bcb8a5 Credi...

CVE-2022-3794

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2022-3794 Jeg Elementor Kit <= 2.5.6 - Authorization Bypass

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

EUVD-2022-43146

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

Security fix for the ALT Linux 10 package openvpn version 2.5.6-alt1

2.5.6-alt1 built May 24, 2022 Andrey Cherepanov in task 300403 --- May 16, 2022 Nikolay A. Fetisov - New version Closes: 42217 - Security fixes: + CVE-2022-0547: possible authentication bypass if multiple authentication plugins tries to do deferred authentication - Fix build with new...

MODX Revolution blind SQL injection

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...

PT-2021-14730 · Jenkins · Jenkins Active Choices Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Choices Plugin versions 2.5.6 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which is exploitable by attackers with Job/Configure permission. This occurs because the parameter nam...

JVN#08191557: WordPress plugin "Paid Memberships Pro" vulnerable to SQL injection

WordPress Plugin "Paid Memberships Pro" contains an SQL injection vulnerability CWE-89. Impact An attacker who can access Paid Membership Pro may obtain and/or alter the information stored in the database. Solution Update the plugin Update the plugin according to the information provided by the...

CVE-2021-25313

A Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6...