Mozilla: iframe Sandbox bypass

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox not protecting against top-level navigations for an iframe sandbox with a policy relaxed through a keyword likely to allow top-navigation-by-user-activation...

Mozilla: iframe Sandbox bypass

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox not protecting against top-level navigations for an iframe sandbox with a policy relaxed through a keyword likely to allow top-navigation-by-user-activation...

Mozilla Firefox 安全特征问题漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a security signature issue vulnerability that stems from improper protection of top-level navigation in the iframe sandbox, which relaxes policies for keywords such as...

Coru LFMember <= 1.0.2 - Arbitrary Game Deletion/Activation via CSRF

The plugin does not have CSRF in place when deleting and activating games, which could allow attacker to make a logged in admin perform such actions PoC...

CVE-2022-0851

There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line v...

Convert2RHEL 信息泄露漏洞

Convert2RHEL is a tool. Automatically convert Oracle/CentOS/Scientific/Rocky/Alma Linux to Red Hat Enterprise Linux. Convert2RHEL suffers from a security vulnerability that stems from the application of the --activationkey option when used with convert2rhel, where the activation key is subsequent...

The vulnerability of the Umbraco CMS content management system, related to the manipulation of cross-site requests, allows a hacker to activate, deactivate, or delete user accounts.

The vulnerability of the Umbraco CMS content management system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to activate, deactivate, or delete user accounts through a specially created web page...

WordPress plugin Access Demo Importer cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Access Demo Importer 1.0.7 and earlier versions are vulnerable to cross-site request...

CVE-2022-23975

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

CVE-2022-23975

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

CVE-2022-23975 WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

CVE-2022-23975: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

WordPress Wbcom Designs – BuddyPress Member Reviews plugin <= 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Member Reviews plugin versions = 2.6.1. Solution Update the WordPress Wbcom Designs – BuddyPress Member Reviews plugin to the latest available version at leas...

WordPress Woo Audio Preview plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Woo Audio Preview plugin versions = 1.3.0. Solution Update the WordPress Woo Audio Preview plugin to the latest available version at least 1.4.0...

WordPress Wbcom Designs – BuddyPress Search plugin <= 1.2.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Search plugin versions = 1.2.0. Solution Deactivate and delete. This plugin has been closed as of March 9, 2022 and is not available for download. This closur...

WordPress Wbcom Designs – BuddyPress Group Reviews plugin <= 2.8.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Group Reviews plugin versions = 2.8.0. Solution Update the WordPress Wbcom Designs – BuddyPress Group Reviews plugin to the latest available version at least...

Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation

Multiple Plugins from Wbcom Designs have an AJAX action without authorisation and CSRF checks, allowing any logged in user to install, activate or deactivate a plugin on the site. PoC fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded", , "body":...

Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation

Multiple Plugins from Wbcom Designs have an AJAX action without authorisation and CSRF checks, allowing any logged in user to install, activate or deactivate a plugin on the site. fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded", , "body":...

WordPress Wbcom BuddyPress Sticky Post premium plugin <= 1.9.7 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress BuddyPress Sticky Post premium plugin versions = 1.9.7. Solution Update the WordPress BuddyPress Sticky Post premium plugin to the latest available version at least 1.9.9...