WordPress plugin ThirstyAffiliates Affiliate Link Manager licensing issue vulnerability (CNVD-2023-06534)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin ThirstyAffiliates Affiliate Link Manager 3.10.5 previously had a security...

CVE-2022-0634

The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the tainsertexternalimage action, allowing a low-privilege user with a role as low as Subscriber to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker...

Cross site request forgery (csrf)

The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the tainsertexternalimage action, allowing a low-privilege user with a role as low as Subscriber to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker...

CVE-2022-0634

The CVE concerns the ThirstyAffiliates WordPress plugin prior to 3.10.5, where ta_insert_external_image lacks proper authorization checks and CSRF protection. This enables a low-privilege user (e.g., Subscriber) to attach an image from an external URL to an affiliate link, potentially affecting l...

AZL-9368 CVE-2022-24070 affecting package subversion for versions less than 1.14.2-1

Subversion's moddavsvn is vulnerable to memory corruption. While looking up path-based authorization rules, moddavsvn servers may attempt to use memory which has already been freed. Affected Subversion moddavsvn servers 1.10.0 through 1.14.1 inclusive. Servers that do not use moddavsvn are not...

ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF

The plugin lacks authorization checks in the tainsertexternalimage action, allowing a low-privilege user with a role as low as Subscriber to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the...

Cloudflare Public Bug Bounty: A malicious actor could rotate tokens of a victim, given that he knows the victim's token ID

API tokens of Cloudflare users were vulnerable to unauthorized rotation by malicious actors who knew the victim's token ID due to lack of proper authorization checks. This could lead to DoS for the token owner and the applications that use it. The vulnerability was fixed by enforcing proper acces...

Cross site request forgery (csrf)

The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin...

CVE-2022-22316

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization checks. IBM X-Force ID: 218276...

CVE-2022-22316

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization checks. IBM X-Force ID: 218276...

CVE-2022-0229

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog,...

WordPress plugin 3D FlipBook 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

CVE-2022-22316

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization checks. IBM X-Force ID: 218276...

CVE-2022-24755

Removed by vendor...

SAP Financial Consolidation Access Control Error Vulnerability

SAP Financial Consolidation is a financial statement solution from SAP Germany. The SAP Financial Consolidation access control error vulnerability, which stems from the program's failure to perform the authorization checks required to update home page messages, could be exploited to cause an...

CVE-2022-26104

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message...

CVE-2022-26104

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message...

WordPress Download Manager plugin access control error vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress's Download Manager plugin version...

CVE-2022-26104

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message...

GenieACS OS Command Injection Vulnerability

GenieACS is a high-performance automatic configuration server ACS for remote management of TR-069-enabled devices. GenieACS is vulnerable to an OS command injection vulnerability, which stems from inadequate input validation and lack of authorization checks, and can be exploited by attackers to...