2127 matches found
CVE-2022-3936 Team Members < 5.2.1 - Editor+ Stored XSS
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in a multisite setup...
WordPress plugin Team Members 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...
Friday Squid Blogging: Grounded Fishing Boat Carrying 16,000 Pounds of Squid
Rough seas are hampering efforts to salvage the boat: The Speranza Marie, carrying 16,000 pounds of squid and some 1,000 gallons of diesel fuel, hit the shoreline near Chinese Harbor at about 2 a.m. on Dec. 15. Six crew members were on board, and all were rescued without injury by another fishing...
Cross-Site Request Forgery (CSRF) in Add Users
Description Hello Team, Create a member functionality is vulnerable for CSRF Attack , by exploiting CSRF vulnerability , attacker can add new Members history.pushState'', '', '/' POC video: https://drive.google.com/file/d/1dN2ug8qjwbz1CGbfuBldwamIFE4BNyH/view?usp=sharing Fix: I just want to sugge...
CVE-2021-4129
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes...
FBI’s Security Platform InfraGard Hacked; 87k Members’ Data Sold Online
By Waqas As seen by Hackread.com, the hacker is selling the stolen InfraGard database which contains the personal data of its members for $50,000. This is a post from HackRead.com Read the original post: FBIs Security Platform InfraGard Hacked; 87k Members Data Sold Online...
Team Members < 5.2.1 - Editor+ Stored XSS
The plugin does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in a multisite setup. PoC 1. Go to the "Teams" section » add a ne...
Improper Access Control
ghost is vulnerable to improper access control. An unprivileged member has the ability to view and change unintended newsletter settings due to improper validation for nested objects in Memebers API...
DRUPAL-CONTRIB-2022-061
Social Flexible Group is an Open Social extension that allows users to create groups with many different configurations. In specific uncommon scenarios, where a platform doesn't have any flexible groups with the "Group members only secret" visibility, community groups are visible to anonymous use...
CVE-2022-45328
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/editmembers.php...
Sql injection
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/editmembers.php...
Church Management System SQL注入漏洞
Church Management System is a church management system. A security vulnerability exists in Church Management System v1.0, which stems from the id parameter of its /admin/editmembers.php component that allows an attacker to implement SQL injection...
CVE-2022-45328
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/editmembers.php...
PT-2022-27467 · Unknown · Church Management System
Name of the Vulnerable Software and Affected Versions: Church Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/edit members.php" API endpoint. Recommendations: For Church...
CVE-2022-45328
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/editmembers.php...
Discourse 信息泄露漏洞
Discourse is an open source community discussion platform. The platform includes features such as communities, e-mail and chat rooms. An information disclosure vulnerability exists in Discourse-calendar, which stems from the fact that its users can list members of private groups or public groups...
grafana: IDOR vulnerability can lead to information disclosure
An Insecure Direct Object Reference IDOR vulnerability was found on Grafana Teams APIs. This flaw impacts the /teams/:teamId, /teams/:search, /teams/:teamId/members API endpoints and may allow an authenticated attacker to view unintended data by querying for the specific team ID or search for tea...
The governor can use the replay attack to manipuate the votes in his favor
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Since the argument of function approveEmergencyDiamondCutAsSecurityCouncilMember does not have the proposalID, a governor can use replay attack to manipulate the votes in his favor, that is, even not...