WooCommerce < 8.1.1 - Shop Manager+ User Metadata Disclosure

Description The plugin returns all user metadata via an AJAX action, which could allow users with a role as low as Shop Manager to access an arbitrary user's metadata which could include tokens and other potentially sensitive data As a shop manager or product vendor admin: Edit an order/create an...

WooCommerce < 8.1.1 - Shop Manager+ User Metadata Disclosure

Description The plugin returns all user metadata via an AJAX action, which could allow users with a role as low as Shop Manager to access an arbitrary user's metadata which could include tokens and other potentially sensitive data PoC As a shop manager or product vendor admin: Edit an order/creat...

Premium Packages - Sell Digital Products Securely < 5.7.5 - Subscriber+ Privilege Escalation

Description The plugin does not check users metadata to be updated, allowing any authenticated users, such as subscriber to set their role via the profilerole parameter when updating their profile...

WP Project Manager < 2.6.5 - Subscriber+ Privilege Escalation

Description The plugin does not have authorisation and does not properly check for the user metadata to be updated via the saveusersmapname function, allowing any authenticated users, such as subscriber to update their role and gain administrator privileges...

Real Estate Manager <= 6.7.1 - Subscriber+ Privilege Escalation

Description The plugin does not validate user metadata to be updated via its remsaveprofilefront function, allowing any authenticated users, such as subscriber to change their role to administrator for example by giving the related wpcapabilities when they update their profile...

CVE-2023-1597

The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves ...

CVE-2023-1597

The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves ...

CVE-2023-1597 tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation

The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves ...

PT-2023-17106 · Tagdiv · Tagdiv Cloud Library

Name of the Vulnerable Software and Affected Versions: tagDiv Cloud Library WordPress plugin versions prior to 2.7 Description: The issue concerns a lack of authorisation and CSRF protection in an AJAX action, which can be accessed by both unauthenticated and authenticated users. This allows...

tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation

The plugin does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog. PoC To set the us...

WordPress Plugin Shortcodes Ultimate 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...

SUSE CVE-2017-1000391

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional...

GHSA-7WW6-75FJ-JCJ7 Cross-site Scripting in Auth0 Lock

Overview In versions before and including 11.32.2, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service usermetdata payload using the name property. Verification emails, when...

GHSA-WFJ3-535M-P6FX Improper Input Validation in Jenkins

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional...

CVE-2022-29172

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before 11.33.0, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code...

CVE-2022-29172 HTML injection with additional signup fields

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before 11.33.0, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code...

CVE-2022-29172 HTML injection with additional signup fields

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before 11.33.0, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code...

CVE-2022-29172

Auth0 Lock (auth0-lock) vulnerability CVE-2022-29172 affects versions before 11.33.0 where the “additional signup fields” feature allows HTML injection into the fields, storing invalid HTML in the user metadata payload (name property). This can cause a crafted link to render HTML in the recipient...

PT-2022-2605 · Auth0 · Auth0

Name of the Vulnerable Software and Affected Versions: Auth0 versions prior to 11.33.0 Description: The issue is related to the "additional signup fields" feature in Auth0, where a malicious actor can inject invalidated HTML code into these fields, which is then stored in the service user metdata...

GHSA-M9CJ-V55F-8X26 Authentication Bypass in keycloak

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...