CVE-2023-0713

The Wicked Folders plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 2.18.16 . The root cause is a missing capability check on the ajax_add_folder function, which allows authenticated attackers with subscriber-level permissions or higher to perform admi...

PT-2023-16469 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is related to a missing capability check on the ajax move object function, allowing authenticated attackers with subscriber-level permissions an...

PT-2023-16474

Name of the Vulnerable Software and Affected Versions Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description The issue is related to a missing capability check on the ajax save folder function, allowing authenticated attackers with subscriber-level permissions and...

CVE-2023-0556

The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata via the function cstugetmetadata that...

CVE-2023-0556

The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata via the function cstugetmetadata that...

Authorization

The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata via the function cstugetmetadata that...

CVE-2023-0556 ContentStudio <= 1.2.5 - Missing Authorization

The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata via the function cstugetmetadata that...

CVE-2023-0556

The CVE-2023-0556 entry affects the ContentStudio WordPress plugin, with an authorization bypass due to missing capability checks in several functions through version 1.2.5. Unauthenticated attackers can retrieve blog metadata, including the contentstudio_token via cstu_get_metadata, enabling fur...

GSD-2023-1001219 fs: don't audit the capability check in simple_xattr_list()

fs: don't audit the capability check in simplexattrlist This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

PT-2023-34296 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.86 Description: The issue is related to the simple xattr list function in the Linux Kernel, where the capability check is not audited. This could potentially lead to security vulnerabilities, although the...

PT-2023-33924

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description The issue concerns the simple xattr list function, where the capability check is not audited. This was introduced in version v3.7 and fixed in version v6.0.16. The actual impact and attack...

PT-2023-34593

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description The issue concerns the Linux Kernel, where the capability check in simple xattr list is not audited. This potential security issue was introduced in version v3.7 and is fixed in version...

PT-2023-34731

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.337 Description The issue concerns the Linux Kernel, where the capability check in simple xattr list is not audited. This potential security issue was introduced in version v3.7 and is fixed in version...

CVE-2023-0293

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to chan...

CVE-2023-0293 Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorization

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to chan...

PT-2023-16148 · WordPress · Mediamatic – Media Library Folders

Name of the Vulnerable Software and Affected Versions: Mediamatic – Media Library Folders plugin for WordPress versions up to, and including, 2.8.1 Description: The issue is related to a missing capability check on AJAX actions, allowing authenticated attackers with subscriber-level permissions a...

PT-2023-8309 · Hostinger · Hostinger Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Hostinger plugin for WordPress versions up to, and including, 1.9.7 Description: The issue is related to the public website function of the Hostinger plugin for WordPress, which has weaknesses in its authorization procedure. This can allow a...

CVE-2022-4555

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...

CVE-2022-4555

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...

Authorization

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate function hooked via init in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can...