9963 matches found
Dahua software products 授权问题漏洞
Dahua software products are a family of applications from Dahua Corporation of China. A security vulnerability exists in several Dahua software products that stems from an unrestricted ICMP request from its remote DSS server that allows an unauthenticated attacker to bypass firewall access contro...
CVE-2022-4106
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server...
CVE-2022-4125
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well...
Cross site request forgery (csrf)
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users along with their posts...
PT-2022-25302 · WordPress · Registration Forms
Name of the Vulnerable Software and Affected Versions: Registration Forms WordPress plugin versions prior to 3.8.1.3 Description: The issue allows unauthenticated attackers to delete arbitrary users, along with their posts, due to a lack of authorisation and CSRF protection when deleting users vi...
Authorization
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...
CVE-2022-4555 WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...
CVE-2022-4555
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...
CVE-2022-4555
The CVE-2022-4555 issue affects the WP Shamsi WordPress plugin (
PT-2022-28033 · Unknown · Puhttpsniff
Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned in the provided descriptions. Description: The "puhttpsniff" service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker ...
CVE-2022-3427
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corneradsettingspage function. This makes it possible for unauthenticated attackers to trigger the deletion of ads v...
Cross site request forgery (csrf)
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corneradsettingspage function. This makes it possible for unauthenticated attackers to trigger the deletion of ads v...
CVE-2022-3427 Corner Ad <= 1.0.56 - Cross-Site Request Forgery
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corneradsettingspage function. This makes it possible for unauthenticated attackers to trigger the deletion of ads v...
Input validation
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters inpu...
CVE-2022-4171 demon image annotation <= 5.0 - Improper Input Restriction Validation
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters inpu...
PT-2022-26039 · WordPress · Demon Image Annotation Plugin
Name of the Vulnerable Software and Affected Versions: demon image annotation plugin for WordPress versions up to, and including 5.0 Description: The issue arises from improper input validation in the plugin, specifically when handling the number of characters supplied during an annotation. Despi...
CVE-2022-44932
An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service...
Design/Logic Flaw
An issue in the component tpisystoolhandle0 /goform/SysToolRestoreSet of Tenda W6-S v1.0.0.4510 allows unauthenticated attackers to arbitrarily reboot the device...