Code injection

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features...

PT-2023-22960 · WordPress · Mstore Api

The MStore API WordPress plugin, specifically versions before 3.9.9, is affected by a security issue that allows visitors to create user accounts with a role of their choice via the wholesale REST API endpoint. This issue is only exploitable if the site owner has paid to access the plugin's pro...

The vulnerability of the microprogramming software used in STARDOM FCJ, FCN-100, FCN-RTU, and FCN-500 programmable logic controllers allows a intruder to execute arbitrary code.

The vulnerability of Yokogawa STARDOM FCJ, FCN-100, FCN-RTU, and FCN-500 controllers is related to the use of rigidly encoded account data. Exploiting this vulnerability allows a malicious actor, who has not undergone identity verification, to execute arbitrary commands...

Barberry Security Advisory - regarding x/auth periodic vesting accounts

Impact In PeriodicVestingAccount, defined in x/auth, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able t...

PT-2023-25498 · Unknown · Projectworlds Online Examination System

Name of the Vulnerable Software and Affected Versions: The Online Examination System Project version 1.0 Description: The issue allows an attacker to perform Cross-Site Request Forgery CSRF attacks. An attacker can create a malicious link that, when clicked by an admin user, will delete a user...

SAMSUNG Pass 授权问题漏洞

SAMSUNG Pass is a secure and easy way to log in to websites and apps on your cell phone using biometrics from South Korea's Samsung SAMSUNG. A security vulnerability exists in versions prior to Samsung Pass 4.2.03.1 that stems from improper authentication and allows a local attacker to access...

PT-2023-22872 · Samsung · Samsung Wallet +1

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.2.03.1 Description: The issue is related to improper authentication in Samsung Pass, allowing a local attacker to access stored account information when Samsung Wallet is not installed. Recommendations: For...

Cross-Site Request Forgery (CSRF)

fastify-oauth2, is vulnerable to Cross-Site Request Forgery. The vulnerability exists due to lack of randomness in the state parameter of index.js which allows an attacker to execute operations within the victim's session, leading to unauthorized access to user accounts...

Code injection

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

Improper Access Control

odoo is vulnerable to Improper Access Control. The vulnerability could allow an authenticated user to remotely trigger the creation of demonstration data which also includes user accounts with known credentials...

SUSE CVE-2023-3297

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...

Authorization

The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it...

Patch me if you can: Cyberattack Series

Many organizations utilize third-party apps for identity security solutions to automate and unburden overtaxed IT admins from tedious tasks that employees can perform via self-service without IT assistance. But in September 2021, our researchers observed threat actors exploiting one such...

Improper Authentication

org.apache.accumulo:accumulo-shell is vulnerable to Improper Authentication. A remote attacker is able to gain access to valid user accounts by providing invalid credentials due to improper checks in THE authentication mechanism...

VulnCheck KEV: CVE-2023-3460

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild...

Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

The plugin does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild. PoC POST /register/ HTTP/1.1 Host: wpscan-vulnerability-test-bench.ddev.site...

GHSA-GH66-FP7J-98V5 Shopware improper mail validation vulnerability

Impact The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. Patches We recommend updating to the current version 5.7.18. You can get the update to...

USN-6190-1 accountsservice vulnerability

Kevin Backhouse discovered that AccountsService incorrectly handled certain D-Bus messages. A local attacker could use this issue to cause AccountsService to crash, resulting in a denial of service, or possibly execute arbitrary code...