PT-2019-14414

Name of the Vulnerable Software and Affected Versions wps-hide-login plugin versions prior to 1.5.3 Description The issue allows for protection bypass due to insufficient validation of the action and key parameters in the login process, specifically when action=rp is used. This could potentially...

PT-2019-14412

Name of the Vulnerable Software and Affected Versions wps-hide-login plugin versions prior to 1.5.3 Description The issue concerns a protection bypass in the wps-hide-login plugin for WordPress. Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later to resolve the issue...

CVE-2019-15824: Undefined Security Weakness

The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass...

CVE-2019-15826: Undefined Security Weakness

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

CVE-2019-15825: Undefined Security Weakness

The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass...

WordPress WPS Cleaner plugin <= 1.4.4 - Cross-Site Request Forgery (CSRF) + media disclosure vulnerabilities

Cross-Site Request Forgery CSRF + media disclosure vulnerabilities found by Julio Potier in WordPress WPS Cleaner plugin versions = 1.4.4. Solution Update the WordPress WPS Cleaner plugin...

WordPress WPS Hide Login plugin <= 1.5.2.2 - Multiples Security Issues

Multiples Security Issues found by Julio Potier in WordPress WPS Hide Login plugin versions = 1.5.2.2. Solution Update the WordPress WPS Hide Login plugin to the latest available version at least 1.5.3...

WordPress WPS Child Themes Generator plugin <= 1.1 - Path Traversal vulnerability

Path Traversal vulnerability found by Julio Potier in WordPress WPS Child Themes Generator plugin versions = 1.1. Solution Update the WordPress WPS Child Themes Generator plugin to the latest available version at least 1.2...

WordPress WPS Bidouille plugin <= 1.12.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability found by Julio Potier in WordPress WPS Bidouille plugin versions = 1.12.2. Solution Update the WordPress WPS Bidouille plugin to the latest available version at least 1.12.4...

WordPress WPS Limit Login plugin <= 1.4.5 - Stored Cross-Site Scripting (XSS) and Protection Bypass vulnerabilities

Stored Cross-Site Scripting XSS and Protection Bypass vulnerabilities found by Julio Potier in WordPress WPS Limit Login plugin versions = 1.4.5. Solution Update the WordPress WPS Limit Login plugin to the latest available version at least 1.4.6...

WordPress WPS Bidouille plugin <= 1.12.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Julio Potier in WordPress WPS Bidouille plugin versions = 1.12.2. Solution Update the WordPress WPS Bidouille plugin to the latest available version at least 1.12.4...

WordPress WPS Bidouille plugin <= 1.12.2 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Julio Potier in WordPress WPS Bidouille plugin versions = 1.12.2. Solution Update the WordPress WPS Bidouille plugin to the latest available version at least 1.12.4...

WPS Cleaner <= 1.4.4 - Multiple Issues

CSRF, Media Dislcosure...

WPS Hide Login <= 1.5.2.2 - Multiples Issues

Protection Bypasses...

WPS Child Themes Generator <= 1.1 - Path Traversal

The WPS Child Theme Generator WordPress plugin was affected by a Path Traversal security vulnerability...

WPS Limit Login <= 1.4.5 - Multiple Issues

Protection Bypass, Stored XSS...

WPS Bidouille <= 1.12.2 - Multiple Issues

CSRF, Stored XSS, Arbitrary File Upload...

CVE-2019-13151

An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi exploitable with authentication via the action setstaenrolleepin5g and the key wpsstaenrolleepin...

CVE-2018-19990

In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pi...

Crestron AMBarco wePresent WiPGExtron ShareLinkTeq AV ITSHARP PN-L703WAOptoma WPS-ProBlackbox HD WPSInFocus LiteShow - Remote Command Injection

Crestron AMBarco wePresent WiPGExtron ShareLinkTeq AV ITSHARP PN-L703WAOptoma WPS-ProBlackbox HD WPSInFocus LiteShow - Remote Command Injection Exploit Title: Barco/AWIND OEM Presentation Platform Unauthenticated Remote Command Injection Date: 05/01/2019 Exploit Author: Jacob Baines Tested on:...