4872 matches found
CVE-2023-5426 Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdmwpdeleteusermeta, pmdmwpdeletetermmeta, and pmdmwpajaxdeletemeta functions in versions up to, and including, 1.2.0. This makes it possible for...
WordPress plugin Post Meta Data Manager security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
WordPress plugin Post Meta Data Manager security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
CVE-2023-46091
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...
CVE-2023-46091
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...
CVE-2023-46091 WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...
CVE-2023-46091
CVE-2023-46091 concerns the WordPress plugin Category SEO Meta Tags by Bala Krishna / Sergey Yakovlev. The initial document states an Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability affecting the plugin versions <= 2.5 . Publicly available connected details confirm the component...
CVE-2023-46091 WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...
Category SEO Meta Tags <= 2.5 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2023-29841 · WordPress · Category Seo Meta Tags
Name of the Vulnerable Software and Affected Versions: Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin versions prior to 2.6 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...
WordPress Post Meta Data Manager Plugin <= 1.2.0 is vulnerable to Broken Access Control
Software Post Meta Data Manager Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5426 Patch priority Medium CVSS severity Medium 7.5 Developer Claim ownership PSID a003d34ca1b2 Credits Francesco Carlucc...
PT-2023-6744 · WordPress · Post Meta Data Manager
Name of the Vulnerable Software and Affected Versions: Post Meta Data Manager plugin for WordPress version 1.2.0 and earlier Description: The issue is related to a missing capability check on the pmdm wp change user meta and pmdm wp change post meta functions. This allows authenticated attackers...
PT-2023-6743 · WordPress · Post Meta Data Manager
Name of the Vulnerable Software and Affected Versions: Post Meta Data Manager plugin for WordPress versions up to, and including, 1.2.0 Description: The issue is related to incorrect authorization procedures in the pmdm wp delete user meta, pmdm wp delete term meta, and pmdm wp ajax delete meta...
WordPress plugin Category SEO Meta Tags Cross-site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WordPress Post Meta Data Manager Plugin <= 1.2.0 is vulnerable to Broken Access Control
Software Post Meta Data Manager Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5425 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 1def5cff52bd Credits Francesco Carlucci...
Design/Logic Flaw
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1...
Elasticsearch Log Information Disclosure Vulnerability
Elasticsearch is a search engine based on the Lucene library. A security vulnerability exists in Elasticsearch that stems from sensitive information being logged in Kibana logs when logging JSON layouts or schema layouts configured to log %meta patterns...
WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)
Software Category SEO Meta Tags Type Plugin Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46618 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c59090fd2bb0 Credits LEE SE HYOUNG...
OpenSolution Quick CMS Cross-Site Scripting Vulnerability
OpenSolution Quick CMS is a free content management system organized by OpenSolution. A cross-site scripting vulnerability exists in OpenSolution Quick CMS v6.7, which stems from the lack of effective filtering and escaping of user-supplied data in the SEO - Meta description parameter of the Page...
Vietnamese DarkGate Malware Targets META Accounts in the UK, USA, India
By Deeba Ahmed The cybersecurity researchers at WithSecure have identified a connection between Vietnamese DuckTail infostealer and DarkGate malware. KEY FINDINGS… This is a post from HackRead.com Read the original post: Vietnamese DarkGate Malware Targets META Accounts in the UK, USA, India...