2966 matches found
PT-2023-14530 · WordPress · Simple Membership
Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.2.2 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admin...
CVE-2023-0254
The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges...
CVE-2023-0254
The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges...
CVE-2023-0254 Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection
The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges...
CVE-2023-0254
The CVE-2023-0254 entry concerns the WordPress plugin Simple Membership WP user Import (versions up to 1.7). The root cause is insufficient escaping of the orderby parameter, enabling an authenticated administrator to inject SQL into existing queries and potentially extract sensitive data from th...
Paid Membership Pro < 2.9.8 - Unauthenticated SQLi
The plugin does not properly sanitise and escape the code parameter before using it in a SQL statement via the /pmpro/v1/order REST route, leading to a SQL injection exploitable by unauthenticated users curl...
SAP Host Agent Access Control Error Vulnerability
SAP Host Agent is a set of agent programs from SAP that supports a number of lifecycle management tasks such as operating system monitoring, database monitoring and system instance monitoring. An Access Control Error vulnerability exists in SAP Host Agent versions 7.21 and 7.22, which arises from...
Paid Membership Pro < 2.9.8 - Unauthenticated SQLi
The plugin does not properly sanitise and escape the code parameter before using it in a SQL statement via the /pmpro/v1/order REST route, leading to a SQL injection exploitable by unauthenticated users PoC curl...
WordPress Simple Membership WP user Import Plugin <= 1.7 is vulnerable to SQL Injection
Software Simple Membership WP user Import Type Plugin Vulnerable versions = 1.7 Fixed in 1.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0254 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 22216492afda Credits Etan Imanol Castro Aldrete Required...
PT-2023-16114 · WordPress · Simple Membership Wp User Import
Name of the Vulnerable Software and Affected Versions: Simple Membership WP user Import plugin for WordPress versions up to, and including, 1.7 Description: The issue allows for SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter. This enables...
WordPress Plugin Simple Membership WP user Import SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Simple Membership WP user...
CVE-2023-0012
In SAP Host Agent Windows - versions 7.21, 7.22, an attacker who gains local membership to SAPLocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAPLocaAdmin are denied the ability to logo...
WordPress Membership For WooCommerce Plugin < 2.1.7 is vulnerable to Arbitrary File Upload
Software Membership For WooCommerce Type Plugin Vulnerable versions 2.1.7 Fixed in 2.1.7 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Upload CVE CVE-2022-4395 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 0a53b711b376 Credits cydave Required...
Simple Membership < 4.2.2 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. 1. Exploit...
Simple Membership < 4.2.2 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. PoC 1. Exploit...
Gym Management System 跨站请求伪造漏洞
Gym Management System is a gym management system. The system is developed in C and sql server and features customer and supplier management, product management, sales management, gym membership management, fitness assessment, system logging, database backup and restore. A security vulnerability...
マイクロソフト 機械学習 メンバーシップ推論コンペティション (MICO) の発表
本ブログは、Announcing the Microsoft Machine Learning Membership Inference Competition MICOの抄訳版です。最新の情報は原文を参照してく...
Announcing the Microsoft Machine Learning Membership Inference Competition (MICO)
We’re excited to announce the launch of a new competition focusing on the security and privacy of machine learning ML systems. Machine learning has already become a key enabler in many products and services, and this trend is likely to continue. It is therefore critical to understand the security...
CVE-2022-39306
CVE-2022-39306 affects Grafana prior to 9.2.4 (and 8.5.x backport to 8.5.15). The issue is improper input validation during the invitation/sign-up flow that admins use to add members to an organization. An invite link can be used to sign up with arbitrary username/email, enabling an attacker to b...
