WordPress WP User Frontend Authorization Issue Vulnerability

WP User Frontend is a wordpress plugin for user frontend posting and submission. An authorization issue vulnerability exists in WordPress WP User Frontend versions prior to 3.5.29. The vulnerability stems from improper privilege management and can be exploited by an attacker to create accounts wi...

CVE-2021-24649

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

Design/Logic Flaw

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

WordPress plugin WP User Frontend 授权问题漏洞

WP User Frontend is a wordpress plugin for user frontend posting and submission. An authorization issue vulnerability exists in WordPress WP User Frontend versions prior to 3.5.29. The vulnerability stems from improper privilege management and can be exploited by an attacker to create accounts wi...

CVE-2021-24649

The CVE refers to the WP User Frontend WordPress plugin prior to version 3.5.29. A user-supplied argument in the registration form, urhidden, encodes the account role (encrypted via wpuf_encryption). If an attacker can access AUTH_KEY and AUTH_SALT (e.g., via arbitrary file access or default keys...

CVE-2021-24649 WP User Frontend < 3.5.29 - Obscure Registration as Admin

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

CVE-2021-24649 WP User Frontend < 3.5.29 - Obscure Registration as Admin

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

SUSE-SU-2022:4007-1 Security update for xen

This update for xen fixes the following issues: - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing bsc1203806. - CVE-2022-33748: Fixed DoS due to race in locking bsc1203807. - CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel version 6.0.9 and earlier, which stems from a memory leak caused by the lack of a dvbfrontenddetach call in its...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel version 6.0.9 and earlier, which stems from a competitive condition in its drivers/media/dvb-core/dvbfrontend.c component that...

SUSE-SU-2022:3971-1 Security update for xen

This update for xen fixes the following issues: - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing bsc1203806. - CVE-2022-33748: Fixed DoS due to race in locking bsc1203807. - CVE-2021-28689: Fixed speculative vulnerabilities with bare non-shim 32-bit PV guests bsc1185104. -...

OESA-2022-2073 ganglia security update

Ganglia is a scalable, real-time monitoring and execution environment with all execution requests and statistics expressed in an open well-defined XML format. Security Fixes: ganglia-web aka Ganglia Web Frontend through 3.7.5 allows XSS via the header.php ce parameter.CVE-2019-20378 ganglia-web a...

ferry 路径遍历漏洞

ferry is lanyulei personal developer based on Gin + Vue + Element UI front-end and back-end separation of the work order system. There is a path traversal vulnerability in ferry, which originates from some unknown functionality in the apis/process/task.go file and can be exploited by an attacker ...

SUSE-SU-2022:3925-1 Security update for xen

This update for xen fixes the following issues: - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing bsc1203806. - CVE-2022-33748: Fixed DoS due to race in locking bsc1203807. - CVE-2021-28689: Fixed speculative vulnerabilities with bare non-shim 32-bit PV guests bsc1185104. -...

TYPO3 Extension femanager vulnerable to Broken Access Control

The TYPO3 Extension femanager prior to versions 5.5.2, 6.3.3, and 7.0.1 is vulnerable to broken access control. The usergroup.inList validation can be bypassed resulting in new frontend users created by the extension may be members of groups that are restricted. The vulnerability is only...

PT-2022-27229 · Typo3 · Femanager

Name of the Vulnerable Software and Affected Versions: femanager extension versions prior to 5.5.2 femanager extension versions 6.x prior to 6.3.3 femanager extension versions 7.x prior to 7.0.1 Description: The issue allows creation of frontend users in restricted groups if there is a usergroup...

WP User Frontend < 3.5.29 - Obscure Registration as Admin

The plugin uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via an arbitrary file access issue for...

WP User Frontend < 3.5.29 - Obscure Registration as Admin

The plugin uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via an arbitrary file access issue for...

WordPress WP User Frontend plugin <= 3.5.28 - Obscure Registration as Admin vulnerability

Obscure Registration as Admin vulnerability discovered by AyeCode Ltd in WordPress WP User Frontend plugin versions = 3.5.28. Solution Update the WordPress WP User Frontend plugin to the latest available version at least 3.5.29...

USN-5706-1: Linux kernel (Azure CVM) vulnerabilities

It was discovered that the BPF verifier in the Linux kernel did not properly handle internal data structures. A local attacker could use this to expose sensitive information kernel memory. CVE-2021-4159 It was discovered that an out-of-bounds write vulnerability existed in the Video for Linux 2...