Role Delegation - Moderately critical - Privilege escalation - SA-CONTRIB-2022-031

This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the administer permissions permission. The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. An...

PT-2022-2057 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.0.0 and earlier Argo CD versions 0.8.0 through 0.9.x Argo CD versions 0.5.0 through 0.7.x Description: The issue is related to an improper access control bug in Argo CD, allowing a malicious user to potentially escalate the...

CVE-2022-0687

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...

CVE-2022-0687

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...

Spoofing

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...

CVE-2022-0687 Amelia < 1.0.46 - Manager+ RCE

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...

CVE-2022-0364

The CVE-2022-0364 entry affects the WordPress plugin Modern Events Calendar Lite (before 6.4.0). The vulnerability arises from insufficient sanitization/escaping of Hourly Schedule parameters, allowing stored Cross-Site Scripting (XSS) for users with privileges as low as contributor. Impact is st...

CVE-2021-23209 WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated admin user role Persistent Cross-Site Scripting XSS vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin versions = 1.0.77.32...

PT-2022-9377 · WordPress · Amp For Wp

Name of the Vulnerable Software and Affected Versions: AMP for WP – Accelerated Mobile Pages WordPress plugin versions = 1.0.77.32 Description: The issue concerns Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities. These vulnerabilities require an admin user role to exploi...

Cross site scripting

Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

Jenkins Folder-based Authorization Strategy Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both products of Jenkins, which is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The plugin fails to escape the role name displayed on the configuration form, which can ...

CVE-2021-24692

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2021-24950

The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insightcustomizeroptionsimport available to any authenticated user, does not validate user input before passing it to unserialize, nor sanitise and escape it before outputting it in the response. ...

WordPress plugin Add Subtitle跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress Add Subtitle has a cross-site scripting vulnerability that stems from failure to clean up or esca...

Orchard Core 安全漏洞

Orchard Core is an open source modular and multi-tenant application framework built with Asp.Net Core and a content management system Cms built on top of the framework from Orchard Core, Inc. Orchard Core is vulnerable to privilege permission and access control issues that could be exploited by a...

CVE-2022-25243

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. Fixed in Vault Enterprise 1.8.9...

CVE-2021-28488

Ericsson Network Manager ENM before 21.2 has incorrect access-control behavior that only affects the level of access available to persons who were already granted a highly privileged role. Users in the same AMOS authorization group can retrieve managed-network data that was not set to be accessib...

MyBB Admin Control Code Injection RCE

This exploit module leverages an improper input validation vulnerability in MyBB prior to 1.8.30 to execute arbitrary code in the context of the user running the application. MyBB Admin Control setting page calls PHP eval function with an unsanitized user input. The exploit adds a new setting,...

CVE-2022-24714

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...

DEBIAN-CVE-2022-24714

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...