2942 matches found
WordPress 信息泄露漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A security vulnerability exists in the WordPress plugin...
Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.5.2, 4.6 for Windows Server 2008 SP2 (KB5001882)
Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.5.2, 4.6 for Windows Server 2008 SP2 KB5001882 Applies to:Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 IMPORTANT Verify that you have installed the required updates...
Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB5001878)
Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 KB5001878 Applies to: Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1...
SYS.2.3.A4
Der Client MUSS zeitnah rebootet werden, nachdem der Kernel des Betriebssystems aktualisiert wurde. Ist dies nicht moeglich, MUSS alternativ Live-Patching des Kernels aktiviert werden. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, a...
User Profile Picture < 2.5.0 - Sensitive Information Disclosure
The REST API endpoint getusers in the plugin returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information. PoC Usage: php poc.php auth...
Edge Redirector Cloudlet Gets Faster
Written by Maksym Novoseltsev - Senior Software Engineer, and Jeffrey Costa - Senior Product Manager, Web Performance Cloudlets Policy Manager often takes a long time to load, which is a by-product of its original design where every policy activation is an individual file. These files must be...
Showmax: https://secure.showmax.com/profile/payments
As part of testing user credentials distribution the security researchers were awarded 3 different activation codes, each one granting them subscription for a different country. The researcher reported that it's possible to use a code for country "A" with account associated to country "B". Such...
VulnCheck KEV: CVE-2020-36719
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...
ListingPro < 2.6.1 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation
Unauthenticated users could install/activate/deactivate arbitrary plugins, including install one from a remote source under their control by having $REQUEST'ccDestin' set to external and $REQUEST'ccFileUrl' to the remote ZIP file...
WordPress ListingPro theme <= 2.6 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability
Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability found by Jerome Bruandet NinTechNet in WordPress ListingPro theme versions = 2.6. Solution Update the WordPress ListingPro theme to the latest available version at least 2.6.1...
systemd bug fix and enhancement update
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes...
Code injection
An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an accountactivations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name...
CVE-2020-29043
BigBlueButton 2.2.29 (and earlier) contains an email-activation bypass: an attacker who can view the account_activations/edit?token= URI can create approved user accounts tied to arbitrary domain emails. The root cause is exposure of the verification token in the GET request, enabling unauthorize...
Subrion Cross-Site Request Forgery Vulnerability
Subrion is a powerful and easy-to-use PHP content management system CMS with full source editing, per-page permissions, user activity monitoring and other powerful features. A cross-site request forgery vulnerability exists in panel/modules/plugins/ in Subrion 4.2.1. An attacker can exploit this...
CVE-2019-7357
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins...
CVE-2019-7357
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins...
PT-2020-11245
Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 Description The issue concerns a CSRF vulnerability in the panel/modules/plugins/ endpoint. This allows an attacker to remotely activate or deactivate plugins. Recommendations For Subrion CMS version 4.2.1, consider...
The vulnerability of microprogrammed software in server boards, server systems, and Intel computing modules relates to the improper activation of a pointer, allowing an attacker to trigger a service failure.
The vulnerability of microprogrammed software in server boards, server systems, and Intel computing modules is related to the exploitation of a faulty pointer. Exploiting this vulnerability can allow attackers to cause service failures...
Nessus Essentials with offline registration and plugin updates
In this episode, I would like to talk about Nessus Essentials and, in particular, how to register and update it without direct internet access. Nothing complicated, but there are a couple of pitfalls that I would like to share. Lets say you need to scan a host in a critical autonomous segment whe...