2127 matches found
WordPress Team Members plugin <= 5.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Tuan in WordPress Team Members plugin versions = 5.0.3. Solution Update the WordPress Team Members plugin to the latest available version at least 5.0.4...
CVE-2020-12461
PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...
vExpert Security 2020 Award Announcement
Thank you to everyone who applied for the vExpert Security sub-group and thank you to the vExpert PRO’s for doing their part in this process. We are pleased to announce the list of 2020 vExperts Security. Each of these vExperts have demonstrated significant contributions to the community and a...
WordPress: Privilege Escalation in BuddyPress core allows Moderate to Administrator
Description: BuddyPress core allows Moderate to Administrator in Manage Group Members module Steps To Reproduce: Step 1 : Create two account with two groups Step 2 : In account A, create group abc with this two users. Step 3 : Administrator in group abc promote account B to Moderator Step 4 : In...
Subrion CMS CSRF Vulnerability
Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site request forgery vulnerability exists in Subrion CMS version 4.1.5 previous versions may also be affected....
UBUNTU-CVE-2020-10080
GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group...
PT-2020-11905 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 8.3 through 12.8.1 Description: The issue allows certain non-members to access the Contribution Analytics page of a private group, resulting in information disclosure. Recommendations: For GitLab versions 8.3 through 12.8.1,...
CVE-2020-9386
In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...
MISA expands with new members and new product additions
Another RSA Conference RSAC and another big year for the Microsoft Intelligent Security Association MISA. MISA was launched at RSAC 2018 with 26 members and a year later we had doubled in size to 53 members. Today, I am excited to share that the association has again doubled in size to 102 member...
GitLab: Members from parent group keep their access level on a subgroup transfer and are invisible
Summary There's an option that allows to transfer groups from one namespace to another, it doesn't work as intended when transferring subgroups from inside a parent group to another group. Users that were part of the first parent group from where the subgroup has been transfered, keep their...
Cross site request forgery (csrf)
An IDOR exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a project owner or maintainer to see the members of any private group via merge request approval rules...
TeleGram-Scraper - Telegram Group Scraper Tool (Fetch All Information About Group Members)
Telegram Group Scraper Tool. Fetch All Information About Group Members • How To Install & Setup API Termux • API Setup Go to http://my.telegram.org and log in. Click on API development tools and fill the required fields. put app name you want & select other in platform Example : copy "apiid" &...
WordPress bbPress Members Only plugin <= 1.2.1 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found in WordPress bbPress Members Only plugin versions = 1.2.1. Solution Update the WordPress bbPress Members Only plugin to the latest available version at least 1.3.1...
bbPress Members Only <= 1.2.1 - CSRF on Optional Settings page
The plugin does not prevent Cross-Site Request Forgery attacks on its 'Optional Settings' page...
kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...
kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...
WordPress Intercom Plugin Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Intercom is an online chat plugin used in it. An information disclosure vulnerability exists in the WordPress Intercom plugin. An...
RISE Ultimate Project Manager Cross-Site Request Forgery Vulnerability
RISE Ultimate Project Manager is used to manage projects, clients and team members. A cross-site request forgery vulnerability exists in index.php/teammembers/addteammember in RISE Ultimate Project Manager 2.3, which can be exploited by an attacker to add authorized users...
Slack-Chat Information Disclosure Vulnerability
Slack-Chat is a jQuery based web chat application. Slack-Chat suffers from an information disclosure vulnerability. An attacker can exploit the vulnerability to obtain a large amount of information about a victim's availability channels, members, etc...
