778 matches found
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
The plugin has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. PoC curl --referer "something" -sIXGET https://example.com/wp-admin/options.php HTTP/2 302 ... location:...
WordPress WPS Hide Login plugin <= 1.9 - Protection Bypass with Referer-Header vulnerability
Protection Bypass with Referer-Header vulnerability discovered by Daniel Ruf in WordPress WPS Hide Login plugin versions = 1.9. Solution Update the WordPress WPS Hide Login plugin to the latest available version at least 1.9.1...
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
The plugin has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. curl --referer "something" -sIXGET https://example.com/wp-admin/options.php HTTP/2 302 ... location:...
CVE-2021-25473
Assuming a shell privilege is gained, an improper exception handling for multisimbarhidebymeadiafull value in SystemUI prior to SMR Oct-2021 Release 1 allows an attacker to cause a permanent denial of service in user device before factory reset...
Samsung SMR 安全漏洞
Samsung SystemUI is a system application for Samsung Samsung mobile devices. A denial of service vulnerability exists in Samsung SystemUI that stems from an exception handling error in SystemUI for multisimbarhidebymeadiafull, which can be exploited by an attacker to cause a denial of service...
Cross-Site Request Forgery (CSRF) in sergix44/xbackbone
✍️ Description following endpoint vulnerable to CSRF: /omeka/upload/1/unpublish Also there is not any different that you run The application in localhost or some real hosts, this is enough to login with a browser that used the browser for online web surfacing too. 🕵️♂️ Proof of Concept // PoC.html...
Top 10 Privacy and Security Features Apple Announced at WWDC 2021
Apple on Monday announced a number of privacy and security-centric features to its upcoming versions of iOS and macOS at its all-online Worldwide Developers Conference. Here is a quick look at some of the big-ticket changes that are expected to debut later this fall: 1 — Decouple Security Patches...
iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass
Both the iThemes Security free and pro versions were affected. - Patched in Version iThemes Security: 7.9.1 - Patched in Version iThemes Security Pro: 6.8.4 The bug allowed attackers to bypass the "Hide Backend" feature, that, when enabled, hides the WordPress wp-login.php and wp-admin pages...
iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass
Both the iThemes Security free and pro versions were affected. - Patched in Version iThemes Security: 7.9.1 - Patched in Version iThemes Security Pro: 6.8.4 The bug allowed attackers to bypass the "Hide Backend" feature, that, when enabled, hides the WordPress wp-login.php and wp-admin pages...
WordPress iThemes Security plugin <= 7.9.0 - Hide Backend Bypass vulnerability
Hide Backend Bypass vulnerability discovered by Julio Potier SecuPress in WordPress iThemes Security plugin versions = 7.9.0. Solution Update the WordPress iThemes Security plugin to the latest available version at least 7.9.1...
WordPress iThemes Security Pro premium plugin <= 6.8.3 - Hide Backend Bypass vulnerability
Hide Backend Bypass vulnerability discovered by Julio Potier SecuPress in WordPress iThemes Security Pro premium plugin versions = 6.8.3. Solution Update the WordPress iThemes Security Pro premium plugin to the latest available version at least 6.8.4...
Lazarus APT Hackers are now using BMP images to hide RAT malware
A spear-phishing attack operated by a North Korean threat actor targeting its southern counterpart has been found to conceal its malicious code within a bitmap .BMP image file to drop a remote access trojan RAT capable of stealing sensitive information. Attributing the attack to the Lazarus Group...
CVE-2021-3332
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via postpassword...
CVE-2021-3332
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via postpassword...
CVE-2021-3332
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via postpassword...
Design/Logic Flaw
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via postpassword...
CVE-2021-3332
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via postpassword...
CVE-2021-3332
The CVE-2021-3332 vulnerability affects the WordPress WPS Hide Login plugin (versions up to 1.6.1). It enables remote attackers to bypass the login-page protection mechanism via the post_password field. Impact is a bypass of protection, with no exploitation details provided in the documents beyon...
WPS Hide Login 安全漏洞
A security vulnerability exists in WPS Hide Login 1.6.1 that allows remote attackers to bypass the protection mechanism via a post password...
Shadow Attacks Let Attackers Replace Content in Digitally Signed PDFs
Researchers have demonstrated a novel class of attacks that could allow a bad actor to potentially circumvent existing countermeasures and break the integrity protection of digitally signed PDF documents. Called "Shadow attacks" by academics from Ruhr-University Bochum, the technique uses the...