VulnCheck KEV: CVE-2021-34621

A vulnerability in the user registration component found in the /src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3...

User can do registration of one CID NFT many times

Lines of code Vulnerability details Impact User can do registration one CID NFT repeatedly, and event CIDNFTAdded will be emited again and again. No checks, that user already registerd. When willl be some logic on frontend, which use this event, it could break, when get one more events CIDNFTAdde...

User may charge any amount of fees when registering a subprotocol

Lines of code Vulnerability details Impact When registering a subprotocol, the user may enter any amount of fees. There are no checks implemented. Proof of Concept The register function does not have a check for the fee. A limit may be imposed otherwise a user can register a subprotocol with any...

Same identity can be assigned to multiple users

Lines of code Vulnerability details Impact In the contest details it is mentioned that identity can be transferable even if it's currently assigned to address in AddressRegistry. However, I would assume that if another address registers it, the identity should be removed from the previous owner...

If no association type matched, user will end up paying fee for nothing

Lines of code Vulnerability details Impact Users can add a new entry for the given subprotocol to the provided CID NFT. There are possible three different association types ordered, primary, active that can be used to model different types of associations between the CID NFT and subprotocol. For...

Atlassian JIRA Data Center 授权问题漏洞

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

CVE-2022-45172

An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected ...

The vulnerability of the PowerScale OneFS operating system, related to the disclosure of information through registration files, allows a perpetrator to disclose protected information.

The vulnerability of the PowerScale OneFS operating system is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker to disclose the protected information...

CVE-2022-45172

LIVEBOX Collaboration vDesk (pre-v018) is affected by a Broken Access Control issue caused by flaws in authorization logic. The vulnerability enables a malicious user with no privileges to escalate to administrator and access other user accounts via three endpoints: /api/v1/registration/validateE...

The vulnerability of the Windows Error Reporting error reporting service on Windows operating systems allows a perpetrator to escalate their privileges.

The vulnerability of the Windows Error Reporting registration service on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2022-4831

The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which...

Cross site scripting

The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which...

CVE-2022-4831 Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro < 1.8.1 - Contributor+ Stored XSS via Shortcode

The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which...

CVE-2022-4831

The CVE-2022-4831 issue affects the WordPress plugin Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro

WordPress plugin Custom User Profile Fields for User Registration 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people.

Lines of code Vulnerability details Impact driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people. Proof of Concept In contract dripsHub their is no mechanism to check a user already registered under driverID or no...

Quick Event Manager < 9.7.5 - Registration Deletion/Update via CSRF

The plugin does not have CSRF checks when deleting and updating registrations, which could allow attackers to make logged in users perform such actions via CSRF attacks...

WordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)

Software User Registration Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23987 Patch priority Low CVSS severity Low 5.9 Developer Masteriyo PSID 518a23296838 Credits Rio Darmawan Required...

MP3 Convert Lord V1.0 Local Seh Exploit

Exploit Title: MP3 Convert Lord V1.0 Local Seh Exploit Date: 06.01.2023 Vendor Homepage: http://www.avlord.com/ Software Link: https://www.softpedia.com/dyn-postdownload.php/baa965c6b5d22d62987a4638f33d5ec1/63b86eb2/3ecb/4/2 Exploit Author: Achilles Tested Version: 1.0 Tested on: Windows 7 x64 1....

Shopware vulnerable to Improper Input Validation of Clearance sale in cart

Impact It is possible to put the same line item multiple one in the cart using API, the Cart Validators checked the line item's individuality and the user was able to skip the clearance sale in cart Patches The problem has been fixed with 6.4.18.1 Workarounds For older versions of 6.1, 6.2, and...