CVE-2021-42791

An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified...

Design/Logic Flaw

An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified...

CVE-2021-42791

The CVE-2021-42791 entry concerns VeridiumID VeridiumAD 2.5.3.0. The vulnerability is an access-control gap in the HTTP trigger for push notifications: an attacker can trigger notifications for other enrolled users, and the notification text can be altered. If the notification recipient accepts, ...

CVE-2021-42791

An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified...

VeridiumAd 环境问题漏洞

VeridiumAd is an enterprise-ready solution from Veridium UK. that adds biometric authentication and identity assurance to Microsoft Active Directory environments. A security vulnerability exists in VeridiumAd 2.5.3.0, which arises from an HTTP request that triggers a push notification for a...

CVE-2022-21867

Windows Push Notifications Apps Elevation of Privilege Vulnerability...

CVE-2022-21867

Windows Push Notifications Apps Elevation of Privilege Vulnerability...

CVE-2022-21867

Windows Push Notifications Apps Elevation of Privilege Vulnerability...

Privilege escalation

Windows Push Notifications Apps Elevation of Privilege Vulnerability...

CVE-2022-21867

Technical details for CVE-2022-21867 are not publicly available in the provided documents. Monitor for updates.

CVE-2022-21867 Windows Push Notifications Apps Elevation of Privilege Vulnerability

...

Windows Push Notifications Apps Elevation of Privilege Vulnerability

...

Microsoft Windows Push Notifications 权限许可和访问控制问题漏洞

Microsoft Windows Push Notifications is a push notification service from Microsoft USA. It provides a reliable way to deliver new updates. Microsoft Windows Push Notifications is vulnerable to privilege permission and access control issues. The following products and editions are affected:Windows...

PT-2022-1502 · Microsoft · Windows Push Notifications Apps +1

Name of the Vulnerable Software and Affected Versions: Windows Push Notifications Apps affected versions not specified Description: The issue is related to insecure privilege management in the Windows Push Notifications Apps component of the Windows operating system. It allows an attacker to...

CVE-2021-20846

Cross-site request forgery CSRF vulnerability in Push Notifications for WordPress Lite versions prior to 6.0.1 allows a remote attacker to hijack the authentication of an administrator and conduct an arbitrary operation via a specially crafted web page...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Push Notifications for WordPress Lite versions prior to 6.0.1 allows a remote attacker to hijack the authentication of an administrator and conduct an arbitrary operation via a specially crafted web page...

CVE-2021-20846

The CVE-2021-20846 entry concerns the WordPress plugin Push Notifications for WordPress (Lite) before version 6.0.1. The connected sources confirm a Cross-site Request Forgery (CSRF) vulnerability that can allow an authenticated administrator to be hijacked to perform arbitrary actions via a craf...

WordPress Plugin "Push Notifications for WordPress (Lite)" vulnerable to cross-site request forgery

Overview WordPress Plugin "Push Notifications for WordPress Lite" provided by Delite Studio contains a cross-site request forgery vulnerability CWE-352. Ten Katouno of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported and coordinated...

JVN#85492429: WordPress Plugin "Push Notifications for WordPress (Lite)" vulnerable to cross-site request forgery

WordPress Plugin "Push Notifications for WordPress Lite" provided by Delite Studio contains a cross-site request forgery vulnerability CWE-352. Impact If a user with an administrative privilege views a malicious page while logged in, unintended operations may be performed. Solution Update the...

WordPress Push Notifications for WordPress (Lite) plugin <= 6.0 - Cross-Site Request Forgery (CSRF) leading to Settings Update

Cross-Site Request Forgery CSRF leading to Settings Update discovered by Ten Katouno in WordPress Push Notifications for WordPress Lite plugin versions = 6.0. Solution Update the WordPress Push Notifications for WordPress Lite plugin to the latest available version at least 6.0.1...