CVE-2015-4038

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...

Code injection

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...

CVE-2015-4038

The WP Membership plugin for WordPress (version 1.2.3) is affected by CVE-2015-4038: remote authenticated users can escalate privileges to Administrator via the iv_membership_update_user_settings action in wp-admin/admin-ajax.php. The vulnerability stems from improper authorization in that AJAX e...

CVE-2015-4038

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...

CVE-2015-4038: Undefined Security Weakness

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...

PT-2015-6395

Name of the Vulnerable Software and Affected Versions WP Membership plugin version 1.2.3 Description The issue allows remote authenticated users to gain administrator privileges. This can be achieved via an iv membership update user settings action to the "wp-admin/admin-ajax.php" endpoint...

SQL injection vulnerability in the id parameter in Ticketmaster ERP web-based ticketing system/Sales/meb_his.aspx?id=.

Ltd. Ticketmaster ERP management system is a special ticket management system for air ticket agents, integrating online booking management, telephone recording screen, corporate travel management, order management in the same industry, membership management, points management, SMS sending, staff...

WordPress WP Membership Plugin Security Bypass Vulnerability

WordPress is a set of blogging platform developed using the PHP language, supporting personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress WP Membership plugin that allows remote attackers to exploit the vulnerability to bypass security restrictions a...

WordPress WP Membership Plugin 1.2.3 Privilege Escalation Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress WP Membership plugin Privilege escalation Contact: https://twitter.com/panVagenas Vendor Homepage: http://wpmembership.e-plugins.com/ Software Link: http://codecanyon.net/item/wp-membership/10066554 Version: 1.2.3 Test...

WordPress WP Membership 1.2.3 Cross Site Scripting

Exploit Title: WordPress WP Membership plugin Stored XSS Contact: https://twitter.com/panVagenas Vendor Homepage: http://wpmembership.e-plugins.com/ Software Link: http://codecanyon.net/item/wp-membership/10066554 Version: 1.2.3 Tested on: WordPress 4.2.2 CVE: CVE-2015-4039...

WordPress WP Membership 1.2.3 Privilege Escalation

Exploit Title: WordPress WP Membership plugin Privilege escalation Contact: https://twitter.com/panVagenas Vendor Homepage: http://wpmembership.e-plugins.com/ Software Link: http://codecanyon.net/item/wp-membership/10066554 Version: 1.2.3 Tested on: WordPress 4.2.2 CVE: CVE-2015-4038 1 Descriptio...

WordPress Plugin WP Membership 1.2.3 - Multiple Vulnerabilities

WordPress Plugin WP Membership 1.2.3 - Multiple Vulnerabilities Exploit Title: WordPress WP Membership plugin Multiple Vulnerabilities Date: 2015/05/19 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://wpmembership.e-plugins.com/ Software Link:...

WordPress WP Membership Plugin 1.2.3 - Multiple Vulnerabilities

There are multiple vulnerabilities in this WordPress Membership plugin. 1. Privilege escalation. Because of this vulnerability, an attacker can take administrative role to the infected website via "ivmembershipupdateusersettings" AJAX action. 2. Stored XSS allows an attacker to login as regular...

WordPress Plugin WP Membership 1.2.3 - Multiple Vulnerabilities

Exploit Title: WordPress WP Membership plugin Multiple Vulnerabilities Date: 2015/05/19 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://wpmembership.e-plugins.com/ Software Link: http://codecanyon.net/item/wp-membership/10066554 Version: 1.2.3...

Would Coalfire Clients benefit from membership with the PCAOB?

Coalfire Controls, LLC Coalfire is a registered Certified Public Accounting CPA firm registered with the American Institute of Certified Public Accountants AICPA and the Colorado State Board of Accountancy, as required to issue Service Organization Control SOC attestation reports in accordance wi...

CVE-2015-0283

The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a request for a 1 group with a large number of members or 2 user that belongs to a large number o...

Hilton Hotel The Official Website of the CSRF vulnerability-vulnerability warning-the black bar safety net

! A world-class hotel chains--Hilton Hotel The Official Website of the aeration CSRF（cross-site request forgery）vulnerabilities, while the CSRF vulnerabilities in the most security researchers eyes not on the“high-risk”, but this vulnerability can be not small. Change the password can be obtained...

sssd: incorrect expansion of group membership when encountering a non-POSIX group

The System Security Services Daemon SSSD 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors...

USN-2516-3 linux vulnerabilities

USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in USN-2516-2 was incomplete. There was an unrelated regression in the use of the virtual counter CNTVCT on arm64 architectures. This update fixes the problem. We apologize for the inconvenience. Original advisory details: A flaw w...

sssd: incorrect expansion of group membership when encountering a non-POSIX group

The System Security Services Daemon SSSD 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors...