521 matches found
Design/Logic Flaw
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a non-existing wxopenid value to the plugin.php ac=wxregister query string...
Authentication flaw
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty wechatcommonmemberwechatmp to gain login access to an account via a plugin.php ac=wxregister request the attacker does not have control over which account will be accessed...
CVE-2018-20422
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty wechatcommonmemberwechatmp to gain login access to an account via a plugin.php ac=wxregister request the attacker does not have control over which account will be accessed...
CVE-2018-20424
Discuz! DiscuzX 3.4 is vulnerable when WeChat login is enabled: a remote attacker can delete the common_member_wechatmp data structure by sending ac=unbindmp to plugin.php. This is documented in CVE-2018-20424 and CNVD-2018-26767, noting a remote deletion Impact. The provided sources do not inclu...
CVE-2018-20423
CVE-2018-20423 affects Discuz! DiscuzX 3.4 when WeChat login is enabled. A logic flaw in plugin.php ac=wxregister allows remote attackers to bypass the “disabled registration” setting by supplying a non-existent wxopenid value, enabling unauthorized registrations. Exploitation details are not pro...
CVE-2018-20422
CVE-2018-20422 affects Discuz! DiscuzX 3.4 when WeChat login is enabled, enabling remote authentication bypass by exploiting a non-empty #wechat#common_member_wechatmp via plugin.php ac=wxregister; attacker does not control target account. This is described across NVD/CNVD records with consistent...
CVE-2018-20424
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the commonmemberwechatmp data structure via an ac=unbindmp request to plugin.php...
CVE-2018-20422
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty wechatcommonmemberwechatmp to gain login access to an account via a plugin.php ac=wxregister request the attacker does not have control over which account will be accessed...
CVE-2018-20423
Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a non-existing wxopenid value to the plugin.php ac=wxregister query string...
Starbucks: unuse domain still in using at wechat by Starbucks East China
Summary: spcc.mobi is still using at wechat offical account by Starbucks East China. but this domain is on sale. Description: I had reported this at reportid=433843，bu your gays had ignored, because they said the domain is unused. In fact, spcc.mobi still having an interface using at wechat offic...
New Ransomware Spreading Rapidly in China Infected Over 100,000 PCs
A new piece of ransomware is spreading rapidly across China that has already infected more than 100,000 computers in the last four days as a result of a supply-chain attack... and the number of infected users is continuously increasing every hour. What's Interesting? Unlike almost every ransomwar...
New Ransomware Spreading Rapidly in China Infected Over 100,000 PCs
A new piece of ransomware is spreading rapidly across China that has already infected more than 100,000 computers in the last four days as a result of a supply-chain attack... and the number of infected users is continuously increasing every hour. What's Interesting? Unlike almost every ransomwar...
WeChat pc client software suffers from arbitrary code execution vulnerability
WeChat is a free application launched by Tencent to provide instant messaging services for smart terminals. The WeChat pc client software suffers from an arbitrary code execution vulnerability, which can be exploited by an attacker with the help of malware to execute arbitrary code DLL files on t...
The defect-week session of the fourth term: XML external entity injection-vulnerability warning-the black bar safety net
Code audit is the use of static analysis to discover the source code of the security flaws of the method can aid in the development or testing personnel in a software on-line prior to a more comprehensive understanding of its security concerns, preventive measures, and therefore has always been t...
WordPress Wechat Broadcast plugin <= 1.2.0 - Local/Remote File Inclusion vulnerability
Local/Remote File Inclusion vulnerability found by Manuel Garcia Cardenas in WordPress Wechat Broadcast plugin versions = 1.2.0. Solution 2018 October 3rd - no patched version available to download. We recommend to deactivate and uninstall...
WordPress Wechat Broadcast Plugin Directory Traversal Vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site.Wechat Broadcast is used in one of the microblogging plug-ins. A directory traversal vulnerability exists in the...
Directory traversal
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter...
CVE-2018-16283
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter...