Prime.sol - User can claim Prime token without having any staked XVS, because his stakedAt isn't reset whenever he is issued an irrevocable token.

Lines of code Vulnerability details Impact Whenever a new Prime token is created, the users stakedAt is reset to 0. This happens when the user claim a revocable token and when he is issue a revocable token, but it does not happen when a user is issue an irrevocable token. This is issue function...

WordPress Inactive Logout Plugin <= 3.2.2 is vulnerable to Broken Access Control

Software Inactive Logout Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44142 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 006870242fb0 Credits Elliot Required privilege...

Inactive Orchestrators and delegators's vote still counts towards as effective when calculating the quota and quorum

Lines of code Vulnerability details Impact Inactive Orchestrators and delegators's vote still counts towards as effective when calculating the quota and quorum Proof of Concept According to the documentation, one of the priorty is to ensure the code implementation matches the LIP specification...

CVE-2023-4478

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2023-4478 Parameter tampering in the registration resulting in blocked accounts to be created

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2023-4478 Parameter tampering in the registration resulting in blocked accounts to be created

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2023-4478

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

Mattermost 注入漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from an inability to limit the parameter values taken from requests during registration, allowing an attacker to register a user as inactive...

PT-2023-29295 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to register users as inactive during signup by manipulating parameters, thus blocking them from later accessing the system without the system admin activatin...

CVE-2023-4478: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2023-27424

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424 WordPress Inactive User Deleter Plugin <= 1.59 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424 WordPress Inactive User Deleter Plugin <= 1.59 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424

CVE-2023-27424 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Inactive User Deleter (Korol Yuriy aka Shra) reported for versions up to 1.59. The issue arises from CSRF in unauthenticated contexts; PatchStack notes the fix is in version 1.60. The vulnerability details...

WordPress Plugin Inactive User Deleter 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Inactive User Deleter < 1.60 - Cross-Site Request Forgery

Description Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

CVE-2023-27424: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin = 1.59 versions...

PT-2023-21113

Name of the Vulnerable Software and Affected Versions Korol Yuriy aka Shra Inactive User Deleter plugin versions = 1.59 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...