MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. PoC The plugin must have a valid purchase code for the request to work curl -X GET --header 'Content-Type: application/json' --header...

WordPress MStore API plugin <= 3.1.9 - Bypass vulnerability in Apple login authentication method

Bypass vulnerability in Apple login authentication method found by Vincent Datrier in WordPress MStore API plugin versions = 3.1.9. Solution Update the WordPress MStore API plugin to the latest available version at least 3.2.0...

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. The plugin must have a valid purchase code for the request to work curl -X GET --header 'Content-Type: application/json' --header 'Accept:...

WordPress MStore API plugin <= 2.1.5 - Unauthenticated Account Create/Edit vulnerability

Unauthenticated Account Create/Edit vulnerability discovered by NinTechNet in WordPress MStore API plugin versions = 2.1.5. Solution Update the WordPress MStore API plugin to the latest available version at least 2.1.6...

MStore API < 2.1.6 - Unauthenticated Arbitrary Account Creation/Edition

The MStore API WordPress plugin was affected by an Unauthenticated Arbitrary Account Creation/Edition security vulnerability...

CVE-2018-20421: Allocation of Resources Without Limits or Throttling

Go Ethereum aka geth 1.8.19 allows attackers to cause a denial of service memory consumption by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly mstore " followed by a "c0xC800000 =...