20388 matches found
CVE-2020-36837
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there ...
ice: Add netif_device_attach/detach into PF reset flow
...
CVE-2020-36837 ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there ...
CVE-2020-36837 ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there ...
CVE-2024-9305
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...
CVE-2024-9305
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the apppresetpassword and validateresetpassword functions not having enough controls to prevent a successful brute forc...
CVE-2024-9305
CVE-2024-9305 (AppPresser – Mobile App Framework, WordPress) affects the AppPresser plugin for WordPress, up to and including version 4.4.4. The root cause is weak access controls in the password-reset flow: appp_reset_password() and validate_reset_password() allow brute-forcing an OTP to change ...
CVE-2024-9104 UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimateaichangepass' function. This makes it possible for unauthenticated...
CVE-2024-9104 UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimateaichangepass' function. This makes it possible for unauthenticated...
CVE-2024-9104
CVE-2024-9104 (UltimateAI for WordPress) is an authentication bypass vulnerability affecting UltimateAI plugin versions up to 2.8.3. The root cause is an improper empty-value check and a missing default activated value check in the function ultimate_ai_change_pass, enabling unauthenticated attack...
kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flowoffloadadd fails, error path...
PT-2024-39522 · WordPress · Wp Timetics- Ai-Powered Appointment Booking Calendar/Online Scheduling Plugin
Name of the Vulnerable Software and Affected Versions: WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress versions up to, and including, 1.0.25 Description: The issue allows for Account Takeover and Privilege Escalation via Insecure Direct Objec...
CVE-2024-9104: Improper Check or Handling of Exceptional Conditions
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimateaichangepass' function. This makes it possible for unauthenticated...
CVE-2020-36837: Missing Authorization
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there ...
PT-2024-39559 · WordPress · Apppresser
Name of the Vulnerable Software and Affected Versions: The AppPresser – Mobile App Framework plugin for WordPress versions up to, and including, 4.4.4 Description: The issue is related to privilege escalation via account takeover. This is due to the appp reset password and validate reset password...
PT-2024-39432 · WordPress · Ultimateai
Name of the Vulnerable Software and Affected Versions: UltimateAI plugin for WordPress versions up to, and including, 2.8.3 Description: The issue is due to the improper empty value check and a missing default activated value check in the ultimate ai change pass function. This allows...
PT-2024-10847
Name of the Vulnerable Software and Affected Versions ThemeGrill Demo Importer plugin for WordPress versions 1.3.4 through 1.6.1 Description The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset wizard actions...
VulnCheck KEV: CVE-2020-36837
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there ...
CVE-2024-9894
A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclos...