760 matches found
Cross-Site Request Forgery (CSRF) in e107inc/e107
✍️ Description Attacker or malicious user is able to change emoticons activation status if a logged in user visits attacker website. 🕵️♂️ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally emoticons deactivated //POC.html history.pushState'', '',...
Print My Blog < 3.4.2 - Plugin Deactivation via CSRF
The plugin does not enforce nonce CSRF checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link PoC...
How to deactivate or delete your Facebook account
People worldwide use Facebook to connect with friends and family, and to engage in pointless debates with strangers over moderately amusing cat videos. But while some feel that the social media platform is an essential part of life, others find the data scandals and privacy issues disconcerting...
How to delete your Twitter account: the deactivation process
You may decide to delete your Twitter account, because social media isn’t for everyone. Perhaps you set up an account to see what the big deal is. Maybe you wanted to hang out with friends but you’re all moving to a new platform. It’s possible the service just isn’t very good and filled with trol...
PYSA Ransomware Pillages Education Sector, Feds Warn
The FBI has issued a warning about an uptick in cyberattacks on the education sector that are delivering the PYSA ransomware. In a “Flash” alert to the cybersecurity community issued on Tuesday, the Feds said that PYSA has been seen in attacks on schools in 12 U.S. states and in the United Kingdo...
SYS.2.3.A1
Administratoren DUERFEN sich NICHT im Normalbetrieb als SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Evernote: CSRF leads to account deactivation of users
Step to reproduce vulnerability:- 1 Create 2 account one account is for attacker and one is for victim 2 With attacker account go to https://www.evernote.com/secure/CloseAccount.action 3 Open your burpsuite and when you will press Deactivate your Evernote account you will see another popup of...
Snapchat: Organization Members in Snap Kit may Deactivate Apps
A member of a Snap Kit organization may deactivate an organization's app, by performing a POST request to https://kit.snapchat.com/api/portal/graphql. even if they are not authorized to do so. This allows a malicious organization member to deactivate the apps of an organization, even if they are...
Insecure Session Management
github.com/argoproj/argo-cd handles session tokens in an insecure manner. The issue arises when it does not check if an account is deactivated before returning a valid token claim...
Dovecot Security Breach
Dovecot is an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. A security vulnerability exists in Dovecot before 2.3.13, which can be exploited by an attacker to access another user's email messages by triggering the deactivation of hibernation with a parameter controlled b...
VulnCheck KEV: CVE-2020-36719
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated...
WordPress ListingPro theme <= 2.6 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability
Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability found by Jerome Bruandet NinTechNet in WordPress ListingPro theme versions = 2.6. Solution Update the WordPress ListingPro theme to the latest available version at least 2.6.1...
ListingPro < 2.6.1 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation
Unauthenticated users could install/activate/deactivate arbitrary plugins, including install one from a remote source under their control by having $REQUEST'ccDestin' set to external and $REQUEST'ccFileUrl' to the remote ZIP file...
Subrion Cross-Site Request Forgery Vulnerability
Subrion is a powerful and easy-to-use PHP content management system CMS with full source editing, per-page permissions, user activity monitoring and other powerful features. A cross-site request forgery vulnerability exists in panel/modules/plugins/ in Subrion 4.2.1. An attacker can exploit this...
CVE-2019-7357
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins...
How to Create a Veeam Account
Challenge A Veeam account grants you access to the Veeam My Account Portal, the platform that allows you to perform the following actions: View Veeam licenses Download Veeam products Raise and update support cases Access Veeam technical resources Send sales inquiries and renewals requests Once yo...
Multiple Themes - Unauthenticated Function Injection
Jerome Bruandet, from nintechnet, discovered numerous themes affected by Unauthenticated Function Injection issues, due to the lack of capability and CSRF nonce checks in AJAX actions. The naturemag-lite theme partially fixed the issues in v1.0.5, however it has been removed from the WordPress...
WordPress CMP – Coming Soon & Maintenance plugin <= 3.8.1 - Unauthenticated Plugin Deactivation vulnerability
Unauthenticated Plugin Deactivation vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin versions = 3.8.1. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version at least 3.8.2...
CMP - Coming Soon & Maintenance < 3.8.2 - Improper Access Controls on AJAX Calls
Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin deactivation...