CVE-2022-1576

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

CVE-2022-1576

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

CVE-2022-1576

The CVE concerns the WP Maintenance Mode & Coming Soon WordPress plugin (pre-2.4.5). The root cause is missing CSRF protection when emptying the subscribed users list, potentially allowing an attacker to induce a logged-in admin to perform this action via a CSRF attack. Reported impact is unautho...

WordPress plugin Maintenance Mode & Coming Soon 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Maintenance Mode...

Vulnerabilities fixed in Google Android and Samsung Mobile

Google has fixed vulnerabilities in Android. In addition to the vulnerabilities fixed by Google fixed vulnerabilities, Samsung itself has fixed 41 other vulnerabilities fixed in Samsung Mobile. The vulnerabilities potentially enable a malicious person to carry out attacks that lead to the followi...

Emerson DeltaV Distributed Control System 加密问题漏洞

Emerson DeltaV Distributed Control System is an automated distributed control system from Emerson. The system includes functions such as network security management, alarm management, batch control, and change management. The Emerson DeltaV Distributed Control System is vulnerable to a...

Ltd. Gold Grid Security Trusted Operation and Maintenance Management System has a logic flaw vulnerability

Golden Grid Security Trusted Operation and Maintenance Management System provides a professional "human-machine" interactive operation and maintenance platform and professional "human-machine" delivery solutions. Ltd. Jin Grid Security Trusted Operation and Maintenance Management System has a log...

CVE-2022-30536

Authenticated Stored Cross-Site Scripting XSS vulnerability in Florent Maillefaud's WP Maintenance plugin = 6.0.7 at WordPress...

WP Maintenance < 6.0.8 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress WP Maintenance plugin <= 6.0.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by m0ze Patchstack in WordPress WP Maintenance plugin versions = 6.0.7 Solution Update the WordPress WP Maintenance plugin to the latest available version at least 6.0.8...

The vulnerability of the TDI protocol implementation in Bently Nevada’s monitoring and protection equipment allows a intruder to trigger a maintenance failure.

The vulnerability of the TDI protocol implementation in Bently Nevada’s monitoring and protection equipment systems is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to cause malfunctions in the maintenance services...

PT-2022-3154 · Bently Nevada · Bently Nevada 3700 Series

Name of the Vulnerable Software and Affected Versions: Bently Nevada 3700 series versions through 2022-04-29 Description: The issue is related to the use of hardcoded credentials in the maintenance interface of the Bently Nevada 3700 series. This interface is accessible on port 4001/TCP. An...

PT-2022-3163 · Emerson · Emerson Deltav Distributed Control System

Name of the Vulnerable Software and Affected Versions: Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 Description: The issue concerns the misuse of passwords in the Emerson DeltaV Distributed Control System. Access to privileged operations on the...

Malicious code in maintainancewebsite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7ce0a00b6a8195cf6c28c677157f83ae315da8c3205b7b9e7f43062611a0f4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4462 Malicious code in maintainancewebsite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7ce0a00b6a8195cf6c28c677157f83ae315da8c3205b7b9e7f43062611a0f4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1945

The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfilteredhtml is disallowed for example in multisite setup...

WordPress plugin Coming Soon and Maintenance by Colorlib 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Coming Soon...

WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF

The plugin is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack PoC...

WordPress WP Maintenance Mode & Coming Soon plugin <= 2.4.4 - Subscribed Users Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Subscribed Users Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress WP Maintenance Mode & Coming Soon plugin versions = 2.4.4. Solution Update the WordPress WP Maintenance Mode & Coming Soon plugin to the latest available version at least 2.4.5...

WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF

The plugin is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack document.getElementById"test".submit;...