PT-2018-14963

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows remote authenticated users to change the administrator password. This is possible because the software uses the value of $ COOKIE'admin '.cookiehash for arbitrary cookie values that are set and n...

CVE-2018-19437: Undefined Security Weakness

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...

WordPress 3.8.2 patch analysis HMAC timing attack-vulnerability warning-the black bar safety net

author: [email protected] 0x00 background On github over and over to see for a long time, the official version of the diff only in php where changes to a location: | 1 2 | - if $hmac != $hash + if hashhmac 'md5', $hmac, $key !== hashhmac 'md5', $hash, $key ---|--- WP developers just...