293 matches found
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Multiple Plugins from Wbcom Designs have an AJAX action without authorisation and CSRF checks, allowing any logged in user to install, activate or deactivate a plugin on the site. PoC fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded", , "body":...
WordPress Wbcom Designs – BuddyPress Activity Filter plugin <= 2.7.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability
Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – BuddyPress Activity Filter plugin versions = 2.7.0. Solution Update the WordPress Wbcom Designs – BuddyPress Activity Filter plugin to the latest available version at...
WordPress Wbcom Designs – Private Community for BuddyPress plugin <= 1.6.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability
Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Wbcom Designs – Private Community for BuddyPress plugin versions = 1.6.0. Solution Update the WordPress Wbcom Designs – Private Community for BuddyPress plugin to the latest available...
maddisondesigns.com Improper Access Control vulnerability OBB-2425337
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress Modern Designs for Gravity Forms plugin <= 1.1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Modern Designs for Gravity Forms plugin versions = 1.1.3. Solution No patched version available...
CVE-2013-20003
Z-Wave devices from Sierra Designs circa 2013 and Silicon Labs using S0 security may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic...
Code injection
Z-Wave devices from Sierra Designs circa 2013 and Silicon Labs using S0 security may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic...
CVE-2013-20003
The CVE-2013-20003 entry describes Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs using S0 security that rely on a known, shared all-zero network key. The root issue is that an attacker within radio range can spoof Z-Wave traffic due to this shared key. Related connected materia...
CVE-2013-20003
Z-Wave devices from Sierra Designs circa 2013 and Silicon Labs using S0 security may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic...
yclstructuraldesigns.ca Improper Access Control vulnerability OBB-2209951
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2018-3639
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a commonly used performance optimization. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the...
CVE-2020-36416
A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module...
leahsdesigns.com.au Improper Access Control vulnerability OBB-1487301
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
rainbowgardendesigns.com Cross Site Scripting vulnerability OBB-1444772
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry
A campaign called Operation Skeleton Key has stolen source code, software development kits, chip designs, and more...
The Subtle Tricks Shopping Sites Use to Make You Spend More
Through deceptive designs known as “dark patterns,” online retailers try to nudge you toward purchases you wouldn’t otherwise make...
Huawei EulerOS: Security Advisory for kvm (EulerOS-SA-2018-1265)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0007)
The remote NewStart CGSL host, running version MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - It was found that the timer functionality in the Linux kernel ALSA subsystem is prone to a race condition between read and ioctl system call handlers, resulting...
NewStart CGSL MAIN 5.04 : dracut Vulnerability (NS-SA-2019-0016)
The remote NewStart CGSL host, running version MAIN 5.04, has dracut packages installed that are affected by a vulnerability: - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly used performance...
EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1515)
According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found where the kernel truncated the value used to indicate the size of a buffer which it would later become zero usin...