CVE-2025-23771

CVE-2025-23771 describes a Missing Authorization vulnerability in the WordPress plugin Push Notification for Post and BuddyPress (Murali Push Notification for Post and BuddyPress). Affected versions are from n/a through 2.11. The issue stems from incorrectly configured access control levels, enab...

WordPress plugin Push Notification for Post and BuddyPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-20899

CVE-2025-20899 concerns an improper access control flaw in Samsung’s PushNotification component. Affected: PushNotification prior to 13.0.00.15 on Android 12, prior to 14.0.00.7 on Android 13, and prior to 15.1.00.5 on Android 14. The root cause is access-control weaknesses that could allow a loc...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices, which stems from an improper access control issue contained in PushNotification...

WordPress All push notification for WP plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin All push notification for WP versions = 1.5.3...

WordPress Push Notification for Post and BuddyPress plugin <= 2.11 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika in WordPress Plugin Push Notification for Post and BuddyPress versions = 2.11...

CVE-2024-12407

CVE-2024-12407 affects the Push Notification for Post and BuddyPress WordPress plugin. It enables a reflected XSS via the pushnotificationid parameter in versions up to and including 2.06, exploitable by unauthenticated attackers who lure a user to perform an action. Impact is described as client...

CVE-2024-12407 Push Notification for Post and BuddyPress <= 2.07 - Reflected Cross-Site Scripting

The Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pushnotificationid' parameter in all versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

WordPress plugin Push Notification for Post and BuddyPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-1834 · WordPress · Push Notification For Post/Buddypress

Name of the Vulnerable Software and Affected Versions: Push Notification for Post and BuddyPress plugin for WordPress versions up to, and including, 2.06 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

CVE-2024-10327

A vulnerability in Okta Verify for iOS versions 9.25.1 beta and 9.27.0 including beta allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects...

CVE-2024-10327

A vulnerability in Okta Verify for iOS versions 9.25.1 beta and 9.27.0 including beta allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects...

CVE-2024-10327

CVE-2024-10327 affects Okta Verify for iOS 9.25.1 (beta)–9.27.0 (including beta). The vulnerability allows push notification responses via the iOS ContextExtension to authenticate regardless of user choice, across scenarios: locked-screen replies, home-screen drag-and-reply, and Apple Watch repli...

CVE-2024-10327

A vulnerability in Okta Verify for iOS versions 9.25.1 beta and 9.27.0 including beta allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects...

Gorush 安全漏洞

Gorush is a push notification server written in Go by Bo-Yi Wu, an individual developer. A security vulnerability exists in Gorush v1.18.4, which stems from the use of a deprecated version of TLS in the RunHTTPServer function. An attacker can use this vulnerability to intercept and manipulate dat...

CVE-2024-39767

Mattermost Mobile Apps versions =2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that...

PT-2024-28665 · Mattermost +1 · Mattermost Mobile Apps +1

Name of the Vulnerable Software and Affected Versions: Mattermost Mobile Apps versions =2.16.0 Description: The issue allows a malicious server to send push notifications with another server's diagnostic ID or server URL, making them appear as legitimate push notifications from the actual server ...

The vulnerability of the Microsoft Edge browser’s Push Notification Service on Android operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft Edge browser’s Push Notification Service on Android operating systems is related to insufficient protection of service-related data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially...

CVE-2022-45169

An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site Open Redirect can occur under the /api/v1/notification/createnotification endpoint, allowing an authenticated user to send an arbitrary push notification to any other user of the system. Th...

CVE-2022-45169

An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site Open Redirect can occur under the /api/v1/notification/createnotification endpoint, allowing an authenticated user to send an arbitrary push notification to any other user of the system. Th...