18207 matches found
CVE-2024-4393
Summary of CVE-2024-4393 : The Social Connect WordPress plugin (vulnerable up to and including 1.2) suffers an authentication bypass due to insufficient verification on the OpenID server during social login. This allows an unauthenticated attacker with email access to log in as any existing site ...
CVE-2024-4393 Social Connect <= 1.2 - Authentication Bypass
The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to lo...
WordPress Social Connect plugin <= 1.2 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Social Connect versions = 1.2...
CVE-2024-4393: Authentication Bypass Using an Alternate Path or Channel
The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to lo...
PT-2024-30790 · WordPress · Social Connect
Name of the Vulnerable Software and Affected Versions: Social Connect plugin for WordPress versions up to, and including, 1.2 Description: The issue is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for...
WordPress Social Connect Plugin <= 1.2 is vulnerable to Privilege Escalation
Software Social Connect Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A8: Software and Data Integrity Failures Classification Privilege Escalation CVE CVE-2024-4393 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID cb56af432b5b Credits István Márton...
WordPress plugin Social Connect has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...
CVE-2024-29206
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge ADB and make unsupported changes to the system. Affected Products: UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18 and earlier UniFi...
CVE-2024-29207
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: UniFi Connect Application Version 3.7.9 and earlier UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18...
CVE-2024-29208
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password. Affected Products: UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18 and earlier UniFi Conne...
CVE-2024-29206
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge ADB and make unsupported changes to the system. Affected Products: UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18 and earlier UniFi...
CVE-2024-29207
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: UniFi Connect Application Version 3.7.9 and earlier UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18...
CVE-2024-29207
CVE-2024-29207 describes an improper certificate validation in Ubiquiti UniFi Connect ecosystem. Affected products and versions: UniFi Connect Application <= v3.7.9, UniFi Connect EV Station <= v1.1.18, UniFi Connect EV Station Pro <= v1.1.18, UniFi Connect Display <= v1.9.324, UniFi ...
CVE-2024-29208
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password. Affected Products: UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18 and earlier UniFi Conne...
CVE-2024-29208
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password. Affected Products: UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18 and earlier UniFi Conne...
CVE-2024-29207
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: UniFi Connect Application Version 3.7.9 and earlier UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18...
CVE-2024-29208
The CVE-2024-29208 vulnerability affects UniFi Connect EV Station (≤ v1.1.18), EV Station Pro (≤ v1.1.18), Display (≤ v1.9.324), and Display Cast (≤ v1.6.225). Root cause: unverified password change via API could allow a malicious actor with API access to change the system password without knowin...
China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion
The MITRE Corporation has offered more details into the recently disclosed cyber attack, stating that the first evidence of the intrusion now dates back to December 31, 2023. The attack, which came to light last month, singled out MITRE's Networked Experimentation, Research, and Virtualization...
Ubiquiti UniFi Connect EV Station security vulnerabilities
The Ubiquiti UniFi Connect EV Station is an electric vehicle station from Ubiquiti USA. A security vulnerability exists in several UniFi products. An attacker exploited the vulnerability to change the system password without knowing the previous password. The following products and versions are...
CVE-2024-29206: Improper Access Control
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge ADB and make unsupported changes to the system. Affected Products: UniFi Connect EV Station Version 1.1.18 and earlier UniFi Connect EV Station Pro Version 1.1.18 and earlier UniFi...