Shield Security < 17.0.18 - Subscriber+ Arbitrary Log Entry Creation

The plugin does not have authorisation in the theme-plugin-file AJAX action, allowing any authenticated users, such as subscriber to call it and add arbitrary audit log entries, which could also lead to Stored XSS due to the lack of escaping of some entry metadata...

WordPress Shield Security Plugin <= 17.0.17 is vulnerable to Cross Site Scripting (XSS)

Software Shield Security Type Plugin Vulnerable versions = 17.0.17 Fixed in 17.0.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0992 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 814ad86ffa89 Credits Ramuel Gall Requir...

WordPress plugin Shield Security 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Shield Security 17.0.17 Cross Site Scripting / Missing Authorization

Affected Plugin: Shield Security – Smart Bot Blocking & Intrusion Prevention Plugin Slug: wp-simple-firewall Affected Versions: = 17.0.17 CVE ID: CVE-2023-0992 CVSS Score: 7.2 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Researcher/s: Ramuel Gall Fully Patched Version: 17.0.18 T...

WordPress Shield Security 17.0.17 Cross Site Scripting / Missing Authorization Vulnerability

WordPress Shield Security Smart Bot Blocking and Intrusion Prevention plugin versions 17.0.17 and below suffer from cross site scripting and missing authorization vulnerabilities. Affected Plugin: Shield Security – Smart Bot Blocking & Intrusion Prevention Plugin Slug: wp-simple-firewall Affected...

THN Webinar: Inside the High Risk of 3rd-Party SaaS Apps

Any app that can improve business operations is quickly added to the SaaS stack. However, employees don't realize that this SaaS-to-SaaS connectivity, which typically takes place outside the view of the security team, significantly increases risk. Whether employees connect through Microsoft 365,...

Authentication Bypass

codeigniter4/shield is vulnerable to Authentication Bypass. The vulnerability exists due to a weak implementation of the password storage functionality which allows an attacker to crack the password if they have access to a user's hashed password...

GHSA-C5VJ-F36Q-P9VG Password Shucking Vulnerability

Impact An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets 1 the user's hashed...

Authorization

CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability...

CVE-2023-27580

CodeIgniter Shield (for CodeIgniter 4) has a vulnerability in its password storage due to an improper implementation, making all hashed passwords stored in Shield v1.0.0-beta.3 or earlier easier to crack. A fix exists: upgrade to Shield v1.0.0-beta.4 or later. After upgrading, all users’ hashed p...

CVE-2023-27580 CodeIgniter Shield Password Shucking Vulnerability

CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability...

CVE-2023-27580 CodeIgniter Shield Password Shucking Vulnerability

CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability...

CodeIgniter Shield 安全漏洞

CodeIgniter Shield is the authentication and authorization module for CodeIgniter 4 from CodeIgniter, Inc. CodeIgniter Shield has a security vulnerability that stems from hashed passwords being easier to crack than expected...

PT-2023-21223 · Unknown · Codeigniter Shield

Name of the Vulnerable Software and Affected Versions: CodeIgniter Shield versions 1.0.0-beta.3 and earlier Description: An improper implementation was found in the password storage process, making all hashed passwords stored in affected versions easier to crack than expected. If an attacker...

How to Tackle the Top SaaS Challenges of 2023

Are you prepared to tackle the top SaaS challenges of 2023? With high-profile data breaches affecting major companies like Nissan and Slack, it's clear that SaaS apps are a prime target for cyberattacks. The vast amounts of valuable information stored in these apps make them a goldmine for hacker...

SUSE CVE-2013-7220

js/ui/screenShield.js in GNOME Shell aka gnome-shell before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search...

The vulnerability of the detection and prevention mechanism for malicious scripts in Avast Script Shield arises from the possibility of the operation exceeding the buffer in memory. This allows attackers to bypass the sandbox protection mechanisms or trigger a service failure.

The vulnerability of the detection and prevention mechanism of Avast Script Shield lies in the fact that the operation escapes the buffer in memory during the loading of the aswjsflt.dll library. Exploiting this vulnerability can allow a malicious actor to bypass the sandbox’s security mechanisms...

CVE-2022-4291

The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Componen...

Heap overflow

The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Componen...

CVE-2022-4291

CVE-2022-4291 affects Avast Antivirus on Windows via the aswjsflt.dll in the Script Shield component, where a heap corruption could allow bypassing the application sandbox. The issue was fixed in Script Shield 18.0.1478. Some sources also note that the vulnerability could cause a Mozilla Firefox ...