1795 matches found
Tilda Publishing <= 0.3.21 - Missing Authorization
Description The Tilda Publishing plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on several functions hooked via AJAX actions such as 'ajaxexportfile,' 'ajaxsync,' 'ajaxgetkeys,' 'ajaxswitcherstatus,' and more in versions ...
Surfer < 1.3.3.379 - Missing Authorization
Description The Surfer plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions, such as removepostdraftconnection, checkdraftstatus, getlocations, getajaxsurferconnecturl, disconnectsurferfromwp, and...
Woocommerce Support System <= 1.2.1 - Missing Authorization
Description The Woocommerce Support System plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on several functions hook via 'init', 'admininit', and AJAX actions in versions up to, and including, 1.2.1. This makes it possible...
CVE-2023-6007
The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to add, modify, or delete use...
Moodle Improper Access Control vulnerability
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
GHSA-FM5H-58G2-4M3F Moodle Improper Access Control vulnerability
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
CVE-2023-5549
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
CVE-2023-5549
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
CVE-2023-5549
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
UBUNTU-CVE-2023-5549
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
CVE-2023-5549 Moodle: insufficient capability checks when updating the parent of a course category
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
CVE-2023-5549
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
CVE-2023-5549 Moodle: insufficient capability checks when updating the parent of a course category
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage...
CVE-2023-5549
CVE-2023-5549 is linked to Moodle and is characterized by insufficient web service capability checks that allow a user who can manage certain categories to move them under a parent category they should not be able to manage. The connected documents (BIT-MOODLE-2023-5549, GHSA-FM5H-58G2-4M3F, and ...
Fedora 39 : moodle (2023-6bd1586dc5)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6bd1586dc5 advisory. Latest updates Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...
Post Meta Data Manager < 1.2.1 - Unauthenticated Data Deletion
Description The plugin does not perform proper capability checks on certain functions, leading to potential unauthorized modification of data. This could result in unauthenticated users being able to delete user, term, and post meta...
Post Meta Data Manager < 1.2.1 - Subscriber+ Privilege Escalation
Description The plugin does not properly implement capability checks on certain functions, which results in potential unauthorized modification of data. As a result, authenticated users with subscriber-level permissions can potentially gain elevated privileges...
Grid Plus < 1.3.3 - Subscriber+ Grid Layout Creation/Deletion/Update
Description The plugin does not properly implement capability checks on the 'gridplussavelayoutcallback' and 'gridplusdeletecallback' functions, leading to unauthorized creation, deletion and update of grid layout by any authenticated users, such as subscriber...
CVE-2023-4823
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change...
CVE-2023-4823
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change...