WordPress WooCommerce Plugin Cross-Site Scripting Vulnerability (CNVD-2021-101686)

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. cross-site scripting vulnerability exists in the...

PT-2021-22983 · Tcman Gim · Tcman Gim

Name of the Vulnerable Software and Affected Versions: TCMAN GIM affected versions not specified Description: The issue is related to the lack of authorization checks when accessing certain resources. A remote attacker could exploit this to access URLs that require privileges without having them,...

CVE-2021-42367

The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the /includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization...

Cross site scripting

The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the /includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization...

Authorization

SAP GRC Access Control - versions V1100700, V1100731, V1200750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges...

CVE-2021-42367 Variation Swatches for WooCommerce <= 2.1.1 Authenticated Stored Cross-Site Scripting

The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the /includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization...

CVE-2021-44233

CVE-2021-44233 affects SAP GRC Access Control versions V1100_700, V1100_731, V1200_750, where an authenticated user may be able to escalate privileges due to insufficient authorization checks. The issue is described as an authorization check gap leading to privilege elevation. No exploitation det...

VulnCheck KEV: CVE-2021-24969

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages such as admin dashboard and frontend. Due to the lack of authorisation and CSRF checks in the wpdmsavetemplate AJAX action, any authenticated users...

CVE-2021-42062

SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts...

CVE-2021-40501

SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker...

Authorization

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to...

CVE-2021-42062

CVE-2021-42062 affects SAP ERP HCM Portugal where a report that reads employee payroll data fails to perform necessary authorization checks. The root cause is missing access controls on that read-only payroll report. Impact is limited to disclosure of payroll information (no data modification or ...

CVE-2021-42062

SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts...

CVE-2021-40502

CVE-2021-40502 affects SAP Commerce versions 2105.3, 2011.13, 2005.18, and 1905.34. The issue stems from missing authorization checks for an authenticated user, enabling privilege escalation to access and edit data from B2B units the user does not belong to. The NVD entry lists CVSS v3.1 base sco...

SAP ERP HCM 安全漏洞

SAP ERP HCM is an enterprise human resource management solution from SAP, Germany. A security vulnerability exists in SAP ERP HCM that stems from the fact that SAP ERP HCM Portugal does not perform the necessary authorization checks on reports that read employee payroll data for a specific region...

SAP Commerce 授权问题漏洞

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management, and operations management. SAP Commerce suffers from an authorization issue vulnerability that stems from the product's lack of authorization...

CVE-2021-24677

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles...

CVE-2021-38345 Brizy <= 1.0.125 and 1.0.127 – 2.3.11 Incorrect authorization checks allowing Post modification

The Brizy Page Builder plugin = 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another...

Multiple Vulnerabilities in Brizy Page Builder Plugin Allow Site Takeover

Note: To receive disclosures like this in your inbox the moment they’re published, you can subscribe to our WordPress Security Mailing List. On August 19, 2021, the Wordfence Threat Intelligence team initiated the Responsible Disclosure process for Brizy - Page Builder, a WordPress plugin install...

WordPress Brizy – Page Builder plugin <= 2.3.11 - Incorrect authorization checks allowing Post modification vulnerability

Incorrect authorization checks allowing Post modification vulnerability discovered by Ramuel Gall WordFence in WordPress Brizy – Page Builder plugin versions = 2.3.11. Solution Update the WordPress Brizy – Page Builder plugin to the latest available version at least 2.3.12...