10442 matches found
CVE-2020-12075
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions...
CVE-2020-12075
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions...
Design/Logic Flaw
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions...
PT-2020-13029 · WordPress · Mappress-Google-Maps-For-Wordpress
Name of the Vulnerable Software and Affected Versions: mappress-google-maps-for-wordpress plugin versions prior to 2.53.9 Description: The issue arises from the incorrect implementation of AJAX functions with nonces or capability checks in the mappress-google-maps-for-wordpress plugin, leading to...
MapPress Maps Pro < 2.53.9 - Remote Code Execution (RCE) due to Incorrect Access Control in AJAX Actions
The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’, and ‘ajaxdelete’ functions in mappresstemplate.php. As such, it is possible for a logged-in attacker with minimal permissions,...
Fedora 31 : bubblewrap (2020-a4206f14f1)
Update to 0.4.1 This release fixes a privilege escalation bug pointed out by Stephen Rttger, where in some setups bubblewrap can be used to gain root permissions. Only version 0.4.0 is vulnerable, and only if installed setuid while at the same time the kernel supports unprivileged user namespaces...
PT-2020-2225 · Linux +7 · Linux Kernel +7
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.6.7 Description: An issue in the Linux kernel allows for an out-of-bounds write due to a lack of headroom validation in xdp umem reg in net/xdp/xdp umem.c. This can be exploited by a user with the CAP NET ADMI...
Responsive Poll < 1.3.4 - Broken Authentication and Missing Capability Checks on AJAX calls
Edit WPScanTeam: In versions 1.3.3, unauthenticated users can manipulate polls, e.g., delete, clone, or view a hidden poll. In versions 1.3.4 any authenticated user can do the same as above v1.3.4 added capability checks, however the issues are still exploitable via CSRF as there is no nonce chec...
Access Restrictions Bypass
The kernel is vulnerable to Access Restrictions Bypass. A missing capability checks were found in the ebtables implementation, used for creating an Ethernet bridge firewall. This could allow a local, unprivileged user to bypass intended capability restrictions and modify ebtables rules...
Privilege Escalation
kernel is vulnerable to privilege escalation. A missing capability check was found in the Linux kernel dochangetype routine. This could allow a local unprivileged user to gain privileged access or cause a denial of service...
PT-2020-12519 · Freerdp +7 · Freerdp +7
Name of the Vulnerable Software and Affected Versions: FreeRDP versions 1.1 through 1.9 Description: A stream out-of-bounds seek in rdp read font capability set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data...
Klarna Checkout for WooCommerce < 2.0.10 - Authenticated Arbitrary Plugin Deactivation, Activation and Installation
The plugin registers one AJAX action intended for installing addon plugins from WordPress.org. The callback method to this action does not have a capability nor nonce check. This enables any logged in user to post a request to the endpoint and install, activate or deactivate any plugin. Since the...
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft
PoC exploit for CVE-2020-0796 - SMBv3 RCE. The target product/service is SMB Server Message Block protocol, specifically SMBv3. The vulnerability class/vector is RCE Remote Code Execution. The probable entry point is the scanner.py script, which sends a specially crafted SMB negotiate request to...
Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS)
Contact Form 7 Datepicker registers an AJAX action to save settings which calls a function that fails to perform a capability check or nonce check. As such, a logged-in attacker with minimal permissions such as a subscriber can send a crafted request which will store a malicious JavaScript in the...
Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS)
Contact Form 7 Datepicker registers an AJAX action to save settings which calls a function that fails to perform a capability check or nonce check. As such, a logged-in attacker with minimal permissions such as a subscriber can send a crafted request which will store a malicious JavaScript in the...
WordPress SEO Plugin - Rank Math < 1.0.41 - Redirect Creation via Unprotected REST API Endpoint
The WordPress SEO Plugin – Rank Math plugin includes a number of optional modules, including a module that can be used to create redirects on a site. In order to add this feature, the plugin registered a REST-API endpoint, rankmath/v1/updateRedirection, which failed to include a permissioncallbac...
Command Execution Vulnerability in Panavision OA e-Office (CNVD-2020-24723)
Panmicro e-office OA system is a professional collaborative OA software for small and medium-sized organizations, a leading brand in the field of domestic collaborative OA office, dedicated to providing professional OA office system, mobile OA applications and other collaborative OA overall...
Changes to Citrix Insight Services (CIS) and Customer Uploads
On March 18, 2020 we had a service disruption with Citrix Insight Services CIS platform which hosted the customer portal at cis.citrix.com, along with Call home, CEIP and few other services. Over the last few days, we have been in the process of bringing up most of the affected services and also...
Monitoring ICS Cyber Operation Tools and Software Exploit Modules To Anticipate Future Threats
There has only been a small number of broadly documented cyber attacks targeting operational technologies OT / industrial control systems ICS over the last decade. While fewer attacks is clearly a good thing, the lack of an adequate sample size to determine risk thresholds can make it difficult f...
TrickBot Now Exploits Infected PCs to Launch RDP Brute Force Attacks
A new module for TrickBot banking Trojan has recently been discovered in the wild that lets attackers leverage compromised systems to launch brute-force attacks against selected Windows systems running a Remote Desktop Protocol RDP connection exposed to the Internet. The module, dubbed...