256 matches found
iThemes Security <= 7.0.2 - Authenticated SQL Injection
The iThemes Security better-wp-security plugin before 7.0.3 for WordPress allows SQL Injection by attackers with Admin privileges via the logs page. Vulnerability description: iThemes Security appears to be vulnerable to time-based SQL-Injection. Parameter orderby is vulnerable because backend...
iThemes Security <= 7.0.2 - Authenticated SQL Injection
The iThemes Security better-wp-security plugin before 7.0.3 for WordPress allows SQL Injection by attackers with Admin privileges via the logs page. Vulnerability description: iThemes Security appears to be vulnerable to time-based SQL-Injection. Parameter orderby is vulnerable because backend...
PT-2018-11300
Name of the Vulnerable Software and Affected Versions iThemes Security better-wp-security plugin version 7.0.3 and earlier Description The issue allows SQL Injection via the logs page, specifically targeting attackers with Admin privileges. Recommendations For versions prior to 7.0.3, update to...
CVE-2018-12636: Improper Neutralization of Special Elements used in an SQL Command
The iThemes Security better-wp-security plugin before 7.0.3 for WordPress allows SQL Injection by attackers with Admin privileges via the logs page...
WordPress iThemes Security Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on PHP and MySQL servers. iThemes Security plugin is a security plugin used in it. A security vulnerability exists in WordPress iThemes Security...
iThemes Security <= 6.9.0 - Cross-Site Scripting (XSS)
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page...
WordPress iThemes Security <=6.9.0 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by Paweł Kuryłowicz in WordPress iThemes Security versions =6.9.0. Solution Update the WordPress iThemes Security plugin to the latest available version at least 6.9.1...
CVE-2018-7433
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page...
CVE-2018-7433
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page...
Design/Logic Flaw
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page...
CVE-2018-7433
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page...
CVE-2018-7433
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page...
CVE-2018-7433
The CVE affects the WordPress iThemes Security plugin prior to 6.9.1. It stems from improper data escaping on the logs page, enabling information disclosure (Confidentiality Impact: High per CVSS). Mitigation: upgrade to 6.9.1 or later. The provided sources confirm the affected component and fix ...
CVE-2018-7433: Insertion of Sensitive Information into Log File
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page...
PT-2018-18067
Name of the Vulnerable Software and Affected Versions iThemes Security plugin versions prior to 6.9.1 Description The issue is related to improper data escaping for the logs page, which could potentially lead to security problems. Recommendations For versions prior to 6.9.1, update to version 6.9...
iThemes Security <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The 404 detection module needs to be enabled. curl "http://ithemesprotected.target/index.php/2016/09/22/trigger-404/?x=String/YWxlcnQoInRlc3QiKQ==/;x=x.substring1,x.length-1;evalatobx;" -H 'Accept-Encoding: gzip, deflate, sdch' -H 'Accept-Language: en-US,en;q=0.8' -H 'Upgrade-Insecure-Requests: 1...
WordPress iThemes Security Plugin <= 5.6.1 - Stored XSS
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...
iThemes Security <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The 404 detection module needs to be enabled. PoC curl "http://ithemesprotected.target/index.php/2016/09/22/trigger-404/?" -H 'Accept-Encoding: gzip, deflate, sdch' -H 'Accept-Language: en-US,en;q=0.8' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 X11; Linux x8664 AppleWebKit/537....
WordPress iThemes Security Plugin Local File Access
A local file access vulnerability exists in WordPress iThemes Security Plugin. Successful exploitation of this vulnerability could allow an attacker to read and obtain backup and log files from the victim's computer...