Contest Gallery < 13.1.0.7 - Subscriber+ Email Address Disclosure

The plugin does not have any proper access controls when exporting users from a gallery, which could allow any authenticated users such as subscriber to list all users from the blog, disclosing their username and email address PoC POST...

Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page Enable reviews for post/pages, and enable the "Show...

Responsive Image Slider, Photo Gallery And Carousel < 1.3.6 - Subscriber+ Arbitrary Post Access

The plugin does not have proper authorisation check in the sfimageid AJAX action, which could allow any authenticated, such as subscriber, to view the content and title of arbitrary posts, for example private, draft and password protected ones. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: /...

CVE-2021-31378

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

Design/Logic Flaw

An Unchecked Return Value vulnerability in the authd authentication daemon of Juniper Networks Junos OS on MX Series configured for subscriber management / BBE allows an adjacent attacker to cause a crash by sending a specific username. This impacts authentication, authorization, and accounting A...

CVE-2021-31366

CVE-2021-31366 is an Unchecked Return Value vulnerability in the authd (authentication daemon) of Juniper Networks Junos OS on MX Series configured for subscriber management/BBE. A adjacent attacker can trigger a crash by sending a specific username, causing a DoS affecting AAA services on affect...

CVE-2021-31366 Junos OS: MX Series: In subscriber management / BBE configuration authd can crash if a subscriber with a specific username tries to login leading to a DoS

An Unchecked Return Value vulnerability in the authd authentication daemon of Juniper Networks Junos OS on MX Series configured for subscriber management / BBE allows an adjacent attacker to cause a crash by sending a specific username. This impacts authentication, authorization, and accounting A...

WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection

The plugin does not escape user input in the seturlswithterms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber...

CVE-2021-31366

An Unchecked Return Value vulnerability in the authd authentication daemon of Juniper Networks Junos OS on MX Series configured for subscriber management / BBE allows an adjacent attacker to cause a crash by sending a specific username. This impacts authentication, authorization, and accounting A...

CVE-2021-31378

In broadband environments, including but not limited to Enhanced Subscriber Management, CHAP, PPP, DHCP, etc., on Juniper Networks Junos OS devices where RADIUS servers are configured for managing subscriber access and a subscriber is logged in and then requests to logout, the subscriber may be...

Juniper Networks Junos OS 安全漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A security vulnerability exists in Juniper Networks Junos OS that arises from the fact that in broadband...

Chameleon CSS <= 1.2 - Subscriber+ SQL Injection

The plugin does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, removecss, also does not sanitise or escape the cssid POST parameter before using it in a SQL...

The Telegraph newspaper exposed 10TB of subscriber data

By Deeba Ahmed The data was exposed due to an unprotected Elasticsearch cluster and remained open to public access without any security authentication. This is a post from HackRead.com Read the original post: The Telegraph newspaper exposed 10TB of subscriber data...

Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL Injection

The plugin does not validate and escape user input passed to the todaytrafficindex AJAX action available to any authenticated users before using it in a SQL statement, leading to an SQL injection issue PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

JobSearch WP Job Board < 1.8.2 - Subscriber+ Arbitrary Blog Options Update

The jobsearchjobintegrationssettinsave AJAX action of the plugin, available to any authenticated user, does not have authorisation and CSRF in place, allowing any authenticated user, such as subscriber to call it and modify arbitrary blog options...

Huawei HarmonyOS 信息泄露漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in a component of Huawei HarmonyOS. An attacker can exploit the vulnerability to bypass the necessary privileges to gain acce...

JobSearch WP Job Board < 1.8.2 - Subscriber+ Add/Update Schedule Calls

The jobsearchaddjobimportschedulecall and jobsearchupdatejobimportschedulecall AJAx action o the plugin, available to any authenticated user do not have authorisation and CSRF check sin place, allowing users with a role as low as subscriber to call them...

Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload

The plugin does not perform capability checks in its spluploadserimg AJAX action available to authenticated users, which could allow any authenticated users, such as subscriber, to upload arbitrary images...

CVE-2021-24633 Countdown Block < 1.1.2 - Missing Authorisation in AJAX action

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the ebwriteblockcss AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users...

WP Import Export Lite < 3.9.5 - Subscriber+ Extensions Update

The plugin does not have any CSRF and authorisation checks done in wpieextsaveextensions AJAX action. This could allow any authenticated user such as subscriber, or an unauthenticated attacker via a CSRF to set the extensions to be used by the plugin, as well as disable all of them To disabled al...