PT-2023-16478 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is due to missing or incorrect nonce validation on the ajax move object function, making it possible for unauthenticated attackers to invoke thi...

CVE-2023-0718: Missing Authorization

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxsavefolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

CVE-2023-0712: Missing Authorization

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxmoveobject function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

CVE-2023-0719: Missing Authorization

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxsavesortorder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke...

CVE-2023-0727: Cross-Site Request Forgery (CSRF)

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxdeletefolder function. This makes it possible for unauthenticated attackers to invoke this function via...

CVE-2023-0713: Missing Authorization

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxaddfolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

CVE-2023-0728: Cross-Site Request Forgery (CSRF)

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxsavefolder function. This makes it possible for unauthenticated attackers to invoke this function via forg...

PT-2023-16474

Name of the Vulnerable Software and Affected Versions Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description The issue is related to a missing capability check on the ajax save folder function, allowing authenticated attackers with subscriber-level permissions and...

PT-2023-16481

Name of the Vulnerable Software and Affected Versions Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description The issue is due to missing or incorrect nonce validation on the ajax delete folder function, making it possible for unauthenticated attackers to invoke thi...

PT-2023-16482 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is due to missing or incorrect nonce validation on the ajax save folder function, making it possible for unauthenticated attackers to invoke thi...

PT-2023-16484 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is due to missing or incorrect nonce validation on the ajax save folder order function, making it possible for unauthenticated attackers to invo...

PT-2023-16470 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is related to a missing capability check on the ajax add folder function, allowing authenticated attackers with subscriber-level permissions and...

WordPress plugin Wicked Folders has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin Wicked Folders has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin Wicked Folders has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-6750

Name of the Vulnerable Software and Affected Versions Dell Command | Integration Suite for System Center versions prior to 6.4.0 Description The issue is related to an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this...

WordPress plugin Wicked Folders has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

shuttle-secrets (>=0.6.0, <=0.7.2), shuttle-static-folder (0.7.3-rc.1) potentially affected by unknown CVE via tokio (1.20.1)

tokio CARGO version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - shuttle-secrets =0.6.0, =0.7.2 - shuttle-static-folder 0.7.3-rc.1 Source cves: unknown CVE Source advisory: OSV:GHSA-4Q83-7CQ4-P6WG...

shuttle-secrets (>=0.6.0, <=0.7.2), shuttle-static-folder (0.7.3-rc.1) potentially affected by unknown CVE via tokio (1.20.1)

tokio CARGO version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - shuttle-secrets =0.6.0, =0.7.2 - shuttle-static-folder 0.7.3-rc.1 Source cves: unknown CVE Source advisory: GHSA-4Q83-7CQ4-P6WG...

shuttle-persist (>=0.8.0, <=0.10.0), shuttle-secrets (>=0.8.0, <=0.10.0) +3 more potentially affected by unknown CVE via tokio (>=1.21.2, <=1.22.0)

tokio CARGO version =1.21.2, =0.8.0, =0.8.0, =0.8.0, =0.10.0 - uff 0.1.0 - wakuchin 0.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-4Q83-7CQ4-P6WG...