WordPress Directorist 7.5.4 Insecure Direct Object Reference / Privilege Escalation

Alongside our usual work to discover, report, and remediate vulnerabilities in the WordPress ecosystem, the WordPress Threat Intelligence team has been conducting a deep-dive into WordPress plugin code with the objective of finding methods to bypass authentication and gain elevated privileges in...

WordPress Directorist 7.5.4 Insecure Direct Object Reference / Privilege Escalation Vulnerabilities

Alongside our usual work to discover, report, and remediate vulnerabilities in the WordPress ecosystem, the WordPress Threat Intelligence team has been conducting a deep-dive into WordPress plugin code with the objective of finding methods to bypass authentication and gain elevated privileges in...

Directorist < 7.5.5 - Subscriber+ Arbitrary User Password Reset to Privilege Escalation

The plugin does not properly validates a user sent a valid password reset token, enabling attackers to take over other user accounts, like administrators...

CVE-2023-0985

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...

CVE-2023-1779 Helmholz and MB Connect Line: Account takeover via password reset in multiple products

Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions =2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact...

CVE-2023-0985 Helmholz and MB Connect Line: Account takeover via password reset in multiple products

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...

CVE-2023-0985 Helmholz and MB Connect Line: Account takeover via password reset in multiple products

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...

Inpiazza Cloud WiFi 安全漏洞

Inpiazza Cloud WiFi is an innovative artificial intelligence platform from Inpiazza, Inc. that allows digital interactions via WiFi interactions. A security vulnerability exists in Inpiazza Cloud WiFi versions prior to v4.2.17 that stems from the portal not enforcing a limit on the number of...

CVE-2023-3007

A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. T...

CVE-2023-3007

A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. T...

CVE-2023-3007

The CVE-2023-3007 entry concerns ningzichun Student Management System 1.0. The vulnerability affects the Password Reset Handler’s resetPassword.php, where manipulating the sid parameter leads to weak password recovery. A remote attacker could exploit this, and public disclosure has occurred. Docu...

CVE-2023-3007 ningzichun Student Management System Password Reset resetPassword.php password recovery

A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. T...

CVE-2023-2549

The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attackers to create a ne...

CVE-2023-2549

The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attackers to create a ne...

Serenity / StartSharp Software File Upload / XSS / User Enumeration / Reusable Tokens

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Serenity and StartSharp Software vulnerable version: 6.7.1 fixed version: 6.7.1 or higher CVE number: CVE-2023-31285, CVE-2023-31286,...

Denial Of Service (DoS)

froxlor/froxlor is vulnerable to Denial Of Service DoS. The vulnerability exists because of a lack of HTTP request validation in the rate-limiting functionality during a password reset, which allows an attacker to crash the application...

CVE-2023-30350

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

CVE-2023-30350

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

Default credentials

FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password...

CVE-2023-30350

CVE-2023-30350 affects FS S3900-24T4S switches. The issue is inadequate access control that lets an authenticated user with guest privileges escalate to admin and reset the admin password. Evidence shows exploitation in practice (e.g., exploit/test material via Packet Storm and Exploit-DB) demons...