WordPress Plugin 'ThemeGrill Demo Importer' 1.3.4 < 1.6.3 Database Wipe and Auth Bypass

The WordPress application running on the remote host has the 'ThemeGrill Demo Importer' plugin that is 1.3.4 or later, but prior to 1.6.3. It is, therefore, vulnerable to an missing authentication check that allows an unauthenticated user to wipe the entire database to its default state and then...

ThemeGrill Demo Importer Plugin for WordPress < 1.6.2 Database Wipe and Authentication Bypass

The WordPress ThemeGrill Demo Importer Plugin installed on the remote host is affected by a database wipe and authentication bypass vulnerability due to improper access controls. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

WordPress ThemeGrill Demo Importer Plugin 1.3.4 < 1.6.3 Authentication Bypass and Database Wipe Vulnerability

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe

There is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator. Edit WPScanTeam: v1.6.2 was released with an insufficient fix, allowing attackers to still exploit the issue using a CSR...

VulnCheck KEV: CVE-2020-36333

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...

ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe

There is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator. Edit WPScanTeam: v1.6.2 was released with an insufficient fix, allowing attackers to still exploit the issue using a CSR...

CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

Design/Logic Flaw

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5114

The core CVE-2013-5114 issue is described across multiple connected sources as affecting LastPass before version 2.5.1 and enabling a secure wipe bypass. The available documents confirm the affected software/version and the impact (bypass of secure wipe), but do not provide technical details on r...

CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5114: Improper Authentication

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2019-8512

This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure...

CVE-2019-8512

This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure...

Design/Logic Flaw

This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure...

CVE-2019-8512

This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure...

CVE-2019-8512

CVE-2019-8512 concerns iOS (Exchange ActiveSync) where a user may inadvertently permit an enterprise administrator to remotely wipe their device without proper disclosure. The issue is described as fixed in iOS 12.2; remediation is to update to iOS 12.2 or later. The publicly documented impact is...

CVE-2019-8512: Incorrect Authorization

This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure...

A week in security (June 24 – 30)

Last week on Malwarebytes Labs, we peeled back the mystery on an elusive malware campaign that relied on blank JavaScript injections, detailed for readers our latest telemetry on the tricky GreenFlash Sundown exploit, and looked at one of the top campaigns directing traffic toward scareware pages...

Graffiti - A Tool To Generate Obfuscated One Liners To Aid In Penetration Testing

NOTE : Never upload payloads to online checkers Graffiti is a tool to generate obfuscated oneliners to aid in penetration testing situations. Graffiti accepts the following languages for encoding: Python Perl Batch Powershell PHP Bash Graffiti will also accept a language that is not currently on...

About the security content of iOS 12.2

About the security content of iOS 12.2 This document describes the security content of iOS 12.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recen...