WordPress ListingPro theme <= 2.6 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability

Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability found by Jerome Bruandet NinTechNet in WordPress ListingPro theme versions = 2.6. Solution Update the WordPress ListingPro theme to the latest available version at least 2.6.1...

ListingPro < 2.6.1 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation

Unauthenticated users could install/activate/deactivate arbitrary plugins, including install one from a remote source under their control by having $REQUEST'ccDestin' set to external and $REQUEST'ccFileUrl' to the remote ZIP file...

Subrion Cross-Site Request Forgery Vulnerability

Subrion is a powerful and easy-to-use PHP content management system CMS with full source editing, per-page permissions, user activity monitoring and other powerful features. A cross-site request forgery vulnerability exists in panel/modules/plugins/ in Subrion 4.2.1. An attacker can exploit this...

CVE-2019-7357

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins...

How to Create a Veeam Account

Challenge A Veeam account grants you access to the Veeam My Account Portal, the platform that allows you to perform the following actions: View Veeam licenses Download Veeam products Raise and update support cases Access Veeam technical resources Send sales inquiries and renewals requests Once yo...

Multiple Themes - Unauthenticated Function Injection

Jerome Bruandet, from nintechnet, discovered numerous themes affected by Unauthenticated Function Injection issues, due to the lack of capability and CSRF nonce checks in AJAX actions. The naturemag-lite theme partially fixed the issues in v1.0.5, however it has been removed from the WordPress...

WordPress CMP – Coming Soon & Maintenance plugin <= 3.8.1 - Unauthenticated Plugin Deactivation vulnerability

Unauthenticated Plugin Deactivation vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin versions = 3.8.1. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version at least 3.8.2...

CMP - Coming Soon & Maintenance < 3.8.2 - Improper Access Controls on AJAX Calls

Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin deactivation...

CVE-2019-20876

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy...

CVE-2019-20876

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy...

Code injection

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy...

CVE-2019-20876

Mattermost Server contains a vulnerability disclosed as CVE-2019-20876 affecting versions prior to 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The issue allows a user to deactivate themselves, bypassing a policy. Public-connected sources (e.g., Red Hat, CNVD, NVD entries) reiterate this description without ...

CVE-2019-20876

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy...

CVE-2019-20873

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation...

CVE-2019-20873

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation...

CVE-2019-20873

Technical details about CVE-2019-20873 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

Linux/x86 ASLR Deactivation Polymorphic - Shellcode

124 bytes small ASLR deactivation polymorphic shellcode. Title: Linux/x86 - ASLR deactivation polymorphic shellcode 124 bytes Author: Xenofon Vassilakopoulos Date: 2020-06-11 Tested on: Linux 3.13.0-32-generic 57precise1-Ubuntu i686 i386 GNU/Linux Architecture: i686 GNU/Linux Shellcode Length: 12...

Linux/x86 ASLR Deactivation Polymorphic Shellcode (124 bytes)

Title: Linux/x86 - ASLR deactivation polymorphic shellcode 124 bytes Author: Xenofon Vassilakopoulos Date: 2020-06-11 Tested on: Linux 3.13.0-32-generic 57precise1-Ubuntu i686 i386 GNU/Linux Architecture: i686 GNU/Linux Shellcode Length: 124 bytes Original shellcode:...

Rank Math 0.9~1.0.42.1 - Missing Access Controls to Disable Competitor Plugins

Missing access controls on the GET requests to deactivate competitors' plugins. This could allow any authenticated users such as subscribers to deactivate the SEO and Sitemap plugins from competitors. The attack could also be performed via CSRF. PoC...

cPanel Deactivation Restriction Bypass Vulnerability

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions of cPanel prior to 82.0.18. An attacker could exploit the vulnerability to bypass...