Cross site request forgery (csrf)

The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin...

CVE-2022-2355

The CVE-2022-2355 entry affects the WordPress plugin Easy Username Updater (versions prior to 1.0.5). The root cause is lack of CSRF checks, which could allow a logged-in admin to arbitrarily change any user’s username (including the admin). Affected behavior and impact are described in multiple ...

WordPress Plugin Easy Username Updater 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

PT-2022-16067 · WordPress · Easy Username Updater

Name of the Vulnerable Software and Affected Versions: Easy Username Updater WordPress plugin versions prior to 1.0.5 Description: The issue is related to the lack of CSRF checks in the Easy Username Updater WordPress plugin. This could allow attackers to make a logged-in admin change any user's...

Cross site scripting

Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting XSS vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via th...

Easy Username Updater < 1.0.5 - Arbitrary Username Update via CSRF

The plugin does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin...

WordPress Easy Username Updater plugin <= 1.0.4 - Arbitrary Username Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Username Update via Cross-Site Request Forgery CSRF vulnerability discovered by Raad Haddad in WordPress Easy Username Updater plugin versions = 1.0.4. Solution Update the WordPress Easy Username Updater plugin to the latest available version at least 1.0.5...

MAL-2022-6436 Malicious code in teamcity-cloud-agent-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccb122a81ed22fda5455f3bfd97f8d788f7eccef4abf896b70fab28ec31ac2a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in teamcity-cloud-agent-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccb122a81ed22fda5455f3bfd97f8d788f7eccef4abf896b70fab28ec31ac2a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Parallels Desktop Updater Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the update...

The vulnerability of the update check function of the Advanced Updater package, a tool for application packaging by Caphyon Advanced Installer, allows a perpetrator to execute arbitrary code.

The vulnerability of the update check function of the Advanced Updater tool for Caphyon Advanced Installer lies in the fact that code is loaded without being checked for integrity during the processing of the CustomDetection binary with the CustomDetectionParameter parameter. Exploiting this...

CVE-2020-21046

A local privilege escalation vulnerability was identified within the "luminatinetupdaterwineaglegetcom" service in EagleGet Downloader version 2.1.5.20 Stable. This issue allows authenticated non-administrative user to escalate their privilege and conduct code execution as a SYSTEM privilege...

EagleGet Downloader 安全漏洞

EagleGet Downloader is a download manager from EagleGet, Inc. A security vulnerability exists in EagleGet Downloader version 2.1.5.20, which stems from a local elevation of privilege vulnerability in the luminatinetupdaterwineaglegetcom service, which can be exploited by an attacker to escalate i...

CVE-2022-1791

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check...

Cross site request forgery (csrf)

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check...

CVE-2022-1791

The CVE refers to the WordPress plugin One Click Plugin Updater, affected ≤ 2.4.14, which lacks CSRF protection when updating settings. The root cause is missing CSRF checks, enabling a logged-in admin to alter settings via CSRF and disable/hide the updates badge and related checks. Exploitation ...

MAL-2022-6891 Malicious code in vault-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 793f685fc2874ee23391ea2a68206ebf4658fc1e5b41160a20c3ed550d519715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vault-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 793f685fc2874ee23391ea2a68206ebf4658fc1e5b41160a20c3ed550d519715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin One Click Plugin Updater 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Remote code execution

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...