2958 matches found
Ultimate Member < 2.0.46 - Multiple Vulnerabilities
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
Arbitrary Code Execution
Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. It was found that Keystone incorrectly handled authorization failures. If a client attempted to change their tenant membership to one they are not authorized to join, Keystone correctly returned a...
Zomato: [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s)
Summary: Get free zomato gold membership using zomato iOS app. Description: add more details about this vulnerability 1 Login to the zomato iOS application. 2 Select zomato gold from the home screen. 3 Depending on your location, you will see different gold pack options. 4 Select any gold pack. 5...
CVE-2018-17425
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...
CVE-2018-17425
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...
Cross site scripting
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...
CVE-2018-17425
WUZHI CMS 4.1.0 contains a stored XSS vulnerability in the Membership Center’s “I want to ask” -> “detailed description” field (index.php?m=member). Multiple sources (NVD, CNVD, OSV, CVE records) confirm that an attacker can inject script/HTML through this field, leading to stored XSS. No spec...
CVE-2018-17425
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...
Ultimate Membership Pro 7.4.2 <= 7.5 - Arbitrary media include
In addition to cropping/rotating/resizing an image of your choosing, you can abuse the imgUrl feature on versions that it's available on 7.4.2+ at least to make an HTTP request to any site you want. For example, by having it connect to a site you control, you can determine the IP address of the...
Ultimate Membership Pro 7.4.2 <= 7.5 - Arbitrary media include
In addition to cropping/rotating/resizing an image of your choosing, you can abuse the imgUrl feature on versions that it's available on 7.4.2+ at least to make an HTTP request to any site you want. For example, by having it connect to a site you control, you can determine the IP address of the...
Ultimate Membership Pro <= 7.5 - Arbitrary media upload
The ajax-upload.php endpoint doesn't check for the current user's capabilities or that they are even logged in, so we can do a few things we shouldn't be able to do: Without any credentials, you can simply POST the image file in the field ihcfile and it'll store it for you: $ curl -F...
eDirectory - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Admin auth bypass, SQLi and File Disclosure Google Dork: no defacers please ! Date: March 2019 reported to vendor without response :D Exploit Author: Efren Diaz Author contact: https://twitter.com/elefr3n Vendor Homepage:...
eDirectory - SQL Injection
eDirectory - SQL Injection Exploit Title: Admin auth bypass, SQLi and File Disclosure Google Dork: no defacers please ! Date: March 2019 reported to vendor without response :D Exploit Author: Efren Diaz Author contact: https://twitter.com/elefr3n Vendor Homepage: https://www.edirectory.com/...
eDirectory - SQL Injection
Exploit Title: Admin auth bypass, SQLi and File Disclosure Google Dork: no defacers please ! Date: March 2019 reported to vendor without response :D Exploit Author: Efren Diaz Author contact: https://twitter.com/elefr3n Vendor Homepage: https://www.edirectory.com/ Software Link: not available...
WordPress Ultimate-Member 2.0.38 Cross Site Request Forgery / Shell Upload
Exploit Title : WordPress Ultimate-Member Plugins 2.0.38 CSRF Shell Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 05/02/2019 Vendor Homepage : ultimatemember.com Software Download Link : downloads.wordpress.org/plugin/ultimate-member.2.0.38.zip Software...
Gitlab -- Multiple vulnerabilities
Gitlab reports: Remote Command Execution via GitLab Pages Covert Redirect to Steal GitHub/Bitbucket Tokens Remote Mirror Branches Leaked by Git Transfer Refs Denial of Service with Markdown Guests Can View List of Group Merge Requests Guest Can View Merge Request Titles via System Notes Persisten...
Authorization Bypass
sssd is vulnerable to authorization bypass. A local user is able to bypass access restrictions via unknown vectors due to improper identification of group membership when a non-POSIX group is in a group membership chain...
GoUrl Bitcoin Payment Gateway < 1.4.14 - Shell Upload
The GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership WordPress plugin was affected by a Shell Upload security vulnerability...
CVE-2018-17866
CVE-2018-17866 affects the WordPress plugin Ultimate Member – User Profile & Membership (vendor/product: Ultimate Member, affected version
Avoid these Doctor Who Series 11 scams
The new season of Doctor Who has finally landed on television screens around the world, and we’ve started to see the first few signs of spam and other assorted nonsense lumbering online. A rash of YouTube accounts claiming to offer up the new series are making the rounds, all of which generally...