4675 matches found
Cross site scripting
In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting XSS vulnerability...
CVE-2020-22394
In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting XSS vulnerability...
YzmCMS cross-site scripting vulnerabilities
YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. A cross-site scripting vulnerability exists in the member submission feature in YzmCMS 5.5. No detailed vulnerability details are available at this time...
CVE-2020-22394: Improper Neutralization of Input During Web Page Generation
In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting XSS vulnerability...
PT-2020-15460
Name of the Vulnerable Software and Affected Versions YzmCMS version 5.5 Description The member contribution function in the editor of YzmCMS contains a cross-site scripting XSS issue. This allows for potential malicious script injection and execution. No information is provided about the estimat...
WordPress Ultimate Member Plugin <= 2.1.11 Multiple Privilege Escalation Vulnerabilities
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
Ultimate Member Plugin for WordPress Allows Site Takeover
A WordPress plugin installed on more than 100,000 sites has three critical security bugs that each allow privilege escalation – and potentially full control over a target WordPress site. The plugin, called Ultimate Member, allows web admins to add user profiles and membership areas to their web...
WordPress Ultimate Member plugin <= 2.1.11 - Unauthenticated/Authenticated Privilege Escalation
Unauthenticated Privilege Escalation via User Meta vulnerability found by Chloe Chamberland in WordPress Ultimate Member plugin versions = 2.1.11. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.1.12...
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta
An attacker could supply an array parameter for sensitive meta data such as the wpcapabilities user meta which defines a user’s role. During the registration process, submitted registration details were passed to the updateprofile function, and any respective metadata that was submitted, regardle...
Ultimate Member < 2.1.12 - Authenticated Privilege Escalation via Profile Update
Due to the fact that Ultimate Member allowed the creation of new roles, this plugin also made it possible for site administrators to grant secondary Ultimate Member roles for all users upon a /wp-admin profile update. PoC $wpuser, 'pwd' = $wppass, 'rememberme' = 'forever', 'wp-submit' = 'Log+In',...
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Roles
Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability or any custom Ultimate Member role and effectively be granted those privileges. PoC $username, 'firstname-'. $formid =...
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta
An attacker could supply an array parameter for sensitive meta data such as the wpcapabilities user meta which defines a user’s role. During the registration process, submitted registration details were passed to the updateprofile function, and any respective metadata that was submitted, regardle...
VulnCheck KEV: CVE-2020-36155
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Roles
Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability or any custom Ultimate Member role and effectively be granted those privileges. $username, 'firstname-'. $formid =...
Stored Cross-Site Scripting Vulnerability in CupCMS Member Center
CupCMS is a content management system that integrates video, stars, news, comics, community and more. A stored cross-site scripting vulnerability exists in CupCMS Member Center, which can be exploited by attackers to obtain sensitive information such as user cookies...
SQL Injection Vulnerability in YYcms Member Center
YYCMS movie and television, rain rain CMS movie and television, is a fully automatic collection of video sites. YYcms member center has SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...
CVE-2020-13334
In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query...
UBUNTU-CVE-2020-13334
In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query...
PT-2020-13475 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.2.10 GitLab versions prior to 13.3.7 GitLab versions prior to 13.4.2 Description: The issue is related to improper authorization checks in GitLab, allowing a non-member of a project or group to modify the...