273 matches found
Malicious code in hermione-login-plugin (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2473 Malicious code in hermione-login-plugin (npm)
--- -= Per source details. Do not edit below this line.=-...
PT-2024-37210
Name of the Vulnerable Software and Affected Versions: WooCommerce - Social Login plugin for WordPress versions up to, and including, 2.6.2 Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input from the woo slg verify parameter. This...
WordPress WooCommerce Social Login plugin <= 2.6.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by István Márton in WordPress Plugin WooCommerce Social Login versions = 2.6.2...
CVE-2024-5150 Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check
The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activationcode' default value is empty, and the not empty check is missing in the 'lwpajaxregister' function. This makes it possible for...
WordPress Login with phone number Plugin <= 1.7.26 is vulnerable to Privilege Escalation
Software Login with phone number Type Plugin Vulnerable versions = 1.7.26 Fixed in 1.7.27 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-5150 Patch priority High CVSS severity High 9.8 Developer Hamid Alinia PSID a2294e0242d6 Credits István Márton Required...
CVE-2024-4706
The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...
PT-2024-4809
Name of the Vulnerable Software and Affected Versions: WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress versions up to, and including, 27.2 Description: The issue exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's...
WordPress Theme My Login Plugin <= 7.1.6 is vulnerable to Broken Access Control
Software Theme My Login Type Plugin Vulnerable versions = 7.1.6 Fixed in 7.1.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32525 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 11dbddbd2e7f Credits Abdi Pranata Required...
WordPress Plugin Social Share, Social Login and Social Comments Plugin 安全漏洞
WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress Plugin Social Share, Social Login and...
Jenkins: Open redirect vulnerability in OpenShift Login Plugin
A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to conduct phishing attacks caused by an open redirect vulnerability. An attacker can use a specially crafted URL to redirect a victim to arbitrary web sites...
Jenkins: Session fixation vulnerability in OpenShift Login Plugin
A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to bypass security restrictions caused by not invalidating the existing session on login. By persuading a victim to visit a specially crafted Web site, an attacker can gain...
Jenkins: Open redirect vulnerability in OpenShift Login Plugin
A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to conduct phishing attacks caused by an open redirect vulnerability. An attacker can use a specially crafted URL to redirect a victim to arbitrary web sites...
Jenkins: Session fixation vulnerability in OpenShift Login Plugin
A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to bypass security restrictions caused by not invalidating the existing session on login. By persuading a victim to visit a specially crafted Web site, an attacker can gain...
Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
WordPress plugin WIP Custom Login security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
WordPress Login as User or Customer (User Switching) Plugin <= 3.8 is vulnerable to Privilege Escalation
Software Login as User or Customer User Switching Type Plugin Vulnerable versions = 3.8 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51484 Patch priority Low CVSS severity Low 9.8 Developer Claim ownership PSID...
CVE-2023-27461
Cross-Site Request Forgery CSRF vulnerability in Yoohoo Plugins When Last Login plugin = 1.2.1 versions...