phpBB cross-site request forgery vulnerability (CNVD-2020-03226)

phpBB is a set of open source and PHP-based Web forum software . The software has support for multiple languages , multiple databases and customized layout and so on. A cross-site request forgery vulnerability exists in phpBB. An attacker can exploit this vulnerability to approve the identity of...

WordPress Ultimate Member Plugin <= 2.1.2 Multiple Insecure Direct Object Reference Vulnerabilities

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-3683

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

CVE-2019-3683 keystone_json_assignment backend granted access to any project for users in user-project-map.json

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

PT-2020-10908

Name of the Vulnerable Software and Affected Versions SUSE Openstack Cloud 8 versions before commit d7888c75505465490250c00cc0ef4bb1af662f9f Description The issue allows every user listed in the /etc/keystone/user-project-map.json file to be assigned full member role access to every project,...

CVE-2019-3683: Incorrect Permission Assignment for Critical Resource

The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete...

Unspecified Vulnerability in WordPress Ultimate Member

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. An unspecified vulnerability exists in...

CVE-2020-6859

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

Design/Logic Flaw

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

CVE-2020-6859

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

CVE-2020-6859

The CVE-2020-6859 entry corresponds to multiple Insecure Direct Object Reference (IDOR) vulnerabilities in the WordPress Ultimate Member plugin (affected until version 2.1.2) in includes/core/class-files.php. The underlying issue allows remote attackers to modify other users’ profiles and cover p...

CVE-2020-6859

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)

IDOR issues allowing change of other users' profiles and cover photos...

CVE-2020-6859: Authorization Bypass Through User-Controlled Key

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

PT-2020-19271

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.1.3 Description The issue allows remote attackers to change other users' profiles and cover photos via a modified user id parameter. This is related to ajax image upload and ajax resize image function...

Parental Controls – Trend Micro Home Network Security has got you covered

We continue our three-part series on protecting your home and family. If you missed our first part, you can find it here. Are your kids at that formative age when they’re beginning to use mobile devices? How about at that inquisitive age when they start to discover the wonders of the Internet? Or...

This Bug Could Have Let Anyone Crash WhatsApp Of All Group Members

WhatsApp, the world's most popular end-to-end encrypted messaging application, patched an incredibly frustrating software bug that could have allowed a malicious group member to crash the messaging app for all members of the same group, The Hacker News learned. Just by sending a maliciously craft...

Shopify: Shopify Stocky App OAuth Misconfiguration

@vulnh0lic noticed that a staff member without Apps permission was able to access the Stocky app. We determined that this was because of a bug in Stocky's OAuth authentication code, which allowed the user to be granted access to Stocky at the start of the OAuth process rather than the end. This...

CVE-2019-18884

index.php/teammembers/addteammember in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users...

PT-2019-15712

Name of the Vulnerable Software and Affected Versions RISE Ultimate Project Manager version 2.3 Description The issue allows for CSRF when adding authorized users through the 'index.php/team members/add team member' endpoint. Recommendations For version 2.3, consider implementing proper CSRF...