17522 matches found
Security feature bypass
The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for...
CVE-2024-0969 ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API
The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Default Restriction" feature and view restricted post content...
CVE-2024-0701
The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for...
CVE-2024-0701 UserPro <= 5.1.6 - Disabled Membership Registration Bypass
The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for...
CVE-2024-0701
CVE-2024-0701 concerns the WordPress UserPro plugin. The vulnerability is described as a Security Feature Bypass caused by relying on client-side restrictions to enforce the Disable Registration setting, enabling unauthenticated attackers to create accounts even when registration is disabled. Dat...
Security feature bypass
A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key exchange ciphersuites in TLS by setting the USERSASUITES define, it will be vulnerable to the timing variant of the Bleichenbacher attack. An attacker that is...
PT-2024-19276 · Phpmyfaq · Phpmyfaq
Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.5 Description: The 'sharing FAQ' functionality in phpMyFAQ allows any unauthenticated actor to misuse the application to send arbitrary emails to a large range of targets. The front-end of this functionality...
CVE-2024-0701: Client-Side Enforcement of Server-Side Security
The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for...
PT-2024-15762
Name of the Vulnerable Software and Affected Versions UserPro plugin for WordPress versions up to, and including, 5.1.6 Description The issue is related to a Security Feature Bypass in the UserPro plugin for WordPress. This bypass occurs due to the plugin's reliance on client-side restrictions to...
WordPress Plugin User Profile Builder Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
GLSA-202402-05 : Microsoft Edge: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202402-05 Microsoft Edge: Multiple Vulnerabilities - Microsoft Edge Chromium-based Security Feature Bypass Vulnerability CVE-2023-29345 - Microsoft Edge Chromium-based Elevation of Privilege Vulnerability CVE-2023-33143,...
Security feature bypass
A vulnerability classified as problematic has been found in Armcode AlienIP 2.41. Affected is an unknown function of the component Locate Host Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public...
UserPro < 5.1.7 - Disabled Membership Registration Bypass
Description The plugin is vulnerable to Security Feature Bypass, due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings, allowing unauthenticated attackers to register an account even when account registration has...
ZOHO ManageEngine ADAudit Plus SQL Injection Vulnerability
ZOHO ManageEngine ADAudit Plus is used by ZOHO to simplify auditing, demonstrate compliance and detect threats. A SQL injection vulnerability exists in ZOHO ManageEngine ADAudit Plus prior to Build 7271, which stems from a vulnerability in the aggregate report feature that is susceptible to SQL...
Statmic CMS vulnerable to account takeover via XSS and password reset link
Impact HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects: - front-end forms with asset fields without any mime type validation - asset fields in the control panel - asset browser in the control panel Additionally, if the XSS is crafted in a specific...
PT-2024-13652 · Zoho · Zoho Manageengine Adaudit Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions through 7250 Description: The issue is related to SQL Injection in the report export option. Recommendations: For Zoho ManageEngine ADAudit Plus versions through 7250, update to a version later than 725...
BIT-WORDPRESS-MULTISITE-2021-39202
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...
Grafana XSS via adding a link in General feature
Grafana 5.3.1 has XSS via a link on the "Dashboard All Panels General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...
