WordPress Woo Audio Preview plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Woo Audio Preview plugin versions = 1.3.0. Solution Update the WordPress Woo Audio Preview plugin to the latest available version at least 1.4.0...

WordPress Wbcom Designs – BuddyPress Member Reviews plugin <= 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Member Reviews plugin versions = 2.6.1. Solution Update the WordPress Wbcom Designs – BuddyPress Member Reviews plugin to the latest available version at leas...

WordPress Wbcom Designs – BuddyPress Group Reviews plugin <= 2.8.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Group Reviews plugin versions = 2.8.0. Solution Update the WordPress Wbcom Designs – BuddyPress Group Reviews plugin to the latest available version at least...

Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation

Multiple Plugins from Wbcom Designs have an AJAX action without authorisation and CSRF checks, allowing any logged in user to install, activate or deactivate a plugin on the site. PoC fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded", , "body":...

Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation

Multiple Plugins from Wbcom Designs have an AJAX action without authorisation and CSRF checks, allowing any logged in user to install, activate or deactivate a plugin on the site. fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded", , "body":...

WordPress Wbcom BuddyPress Sticky Post premium plugin <= 1.9.7 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress BuddyPress Sticky Post premium plugin versions = 1.9.7. Solution Update the WordPress BuddyPress Sticky Post premium plugin to the latest available version at least 1.9.9...

WordPress Woo Document Preview plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Woo Document Preview plugin versions = 1.3.0. Solution Update the WordPress Woo Document Preview plugin to the latest available version at least 1.4.0...

Use Any Font < 6.2.1 - API Key Deactivation via CSRF

The plugin does not have CSRF check in place when deactivating its API key, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

WordPress Users Ultra plugin <= 3.1.0 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Users Ultra plugin versions = 3.1.0. Solution Deactivate and delete. This plugin has been closed as of March 14, 2022 and is not available for download. This closure is temporary, pending a full review...

Zulip Competition Conditions Issue Vulnerability

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, a contention issue vulnerability exists in Zulip versions 4.0 and prior to 4.11, which stems from the fact that Zul...

CVE-2022-24751

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A...

Race condition

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A...

CVE-2022-24751

CVE-2022-24751 describes a race condition in Zulip during account deactivation. From versions 4.0 up to, but not including, 4.11, a deactivated user could in rare cases retain access due to concurrent actions. The fixes are in Zulip 4.11 on the 4.x branch and 5.0-rc1 on the 5.x branch. Upgrading ...

CVE-2022-24751 Race condition in Zulip

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A...

CVE-2022-24751 Race condition in Zulip

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A...

Zulip 竞争条件问题漏洞

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, a contention issue vulnerability exists in Zulip versions 4.0 and prior to 4.11, which stems from the fact that Zul...

WordPress Opstore theme <= 1.4.3 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Opstore theme versions = 1.4.3. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...

WordPress Doko theme <= 1.0.27 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Doko theme versions = 1.0.27. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...

WordPress Ultra Seven theme <= 1.2.8 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Ultra Seven theme versions = 1.2.8. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...

WordPress Brovy theme <= 1.3 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Brovy theme versions = 1.3. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...