All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion

Thrive “Legacy” themes register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote...

All Thrive Themes and Plugins - Unauthenticated Option Update

The plugins and themes register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty apikey parameter in vulnerable versions if Zapier was not enabled. Attackers coul...

CVE-2021-26069: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/id/ActionsAndOperations API endpoint. The affected versions are before...

BuddyPress < 7.2.1 - REST API Privilege Escalation

The BuddyPress WordPress plugin, versions before 7.2.1, fixed a vulnerability that could allow a privilege escalation from a regular user to Administrator, using the BuddyPress REST API buddypress/v1/members/me endpoint...

IBM Spectrum Scale Unauthorized Access Vulnerability

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

BuddyPress < 7.2.1 - Force a Friendship

The BuddyPress WordPress plugin, versions before 7.2.1, fixed a vulnerability that could allow a member to force a friendship on behalf of another member, using the BuddyPress REST API buddypress/v1/friends endpoint...

BuddyPress < 7.2.1 - Invite Member to Join Group

The BuddyPress WordPress plugin, versions before 7.2.1, fixed a vulnerability that could allow a member to invite another member to join a group without being friends when that group restricted invites to friends only, using BuddyPress Nouveau and the BuddyPress REST API...

BuddyPress < 7.2.1 - Read Private Messages

The BuddyPress WordPress plugin, versions before 7.2.1, fixed a vulnerability that could allow a member to read private messages in a thread they were not invited to, using the BuddyPress REST API buddypress/v1/messages endpoint...

IBM Spectrum Scale Denial of Service Vulnerability (CNVD-2021-20199)

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

CVE-2020-4891

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974...

CVE-2020-4890

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absense of rate limiting. IBM X-Force ID: 190973...

Code injection

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974...

Code injection

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absense of rate limiting. IBM X-Force ID: 190973...

CVE-2020-4890

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absense of rate limiting. IBM X-Force ID: 190973...

CVE-2020-4891

CVE-2020-4891 affects IBM Spectrum Scale: versions 5.0.0–5.0.5.5 and 5.1.0–5.1.0.2 expose an improper account lockout setting that could let a local attacker brute‑force REST API credentials. Affected product: IBM Spectrum Scale (GPFS-based). Root cause: inadequate local account lockout configura...

CVE-2020-4890

IBM Spectrum Scale vulnerability CVE-2020-4890 affects versions 5.0.0–5.0.5.5 and 5.1.0–5.1.0.2. A local user with a valid REST API role can cause a denial of service due to weak or absent rate limiting on REST API requests. The root cause is insufficient rate-limiting controls; impact is availab...

CVE-2020-4891

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974...

CVE-2020-4891: Improper Restriction of Excessive Authentication Attempts

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974...

CVE-2020-4890: Undefined Security Weakness

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absense of rate limiting. IBM X-Force ID: 190973...

Security Bulletin: Multiple vulnerabilities affect the IBM Spectrum Scale GUI.

Summary Vulnerabilities exist in all levels of IBM Spectrum Scale GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4890 DESCRIPTION: IBM Spectrum Scale could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absen...