WordPress Role Based Pricing for WooCommerce premium plugin <= 1.6.2 - Auth. PHAR Deserialization vulnerability

Auth. PHAR Deserialization vulnerability discovered by WPScan in WordPress Role Based Pricing for WooCommerce premium plugin versions = 1.6.2. Solution Update the WordPress Role Based Pricing for WooCommerce plugin to the latest available version at least 1.6.3...

WordPress Role Based Pricing for WooCommerce premium plugin <= 1.6.1 - Auth. Arbitrary File Upload vulnerability

Auth. Arbitrary File Upload vulnerability discovered by WPScan in WordPress Role Based Pricing for WooCommerce premium plugin versions = 1.6.1. Solution Update the WordPress Role Based Pricing for WooCommerce plugin to the latest available version at least 1.6.2...

Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX Calls

The plugin does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options To set the default role for new users to administrator, run the below command in t...

Complianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLi

The plugins allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML. 1. Install Complianz and set the following options ...

CVE-2019-14841

A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin privileges in the Business Central Console...

CVE-2019-14841

CVE-2019-14841 affects Red Hat Decision Manager (RHDM) . An authenticated attacker can mutate their role in the HTTP response header, enabling escalation to admin privileges in the Business Central Console . Root cause: improper handling of role assignment in header processing within RHDM. Impact...

CVE-2022-36803

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox...

CVE-2022-36803

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox...

CVE-2022-36803

The CVE-2022-36803 vulnerability affects Atlassian Jira Align Server prior to version 10.109.2, due to improper access control in the MasterUserEdit API. An authenticated attacker with the People role can use MasterUserEdit to elevate any user’s role to Super Admin. The issue is explicitly tied t...

Atlassian Jira 安全漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage various types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira versions prior to 10.109.2, which stems from a vulnerability in the...

WordPress Optinly plugin <= 1.0.11 - Broken Access Control vulnerability

Broken Access Control leading to plugin settings change by the subscriber or higher role user vulnerability discovered by ptsfence Patchstack in WordPress Optinly plugin versions = 1.0.11. Solution No patched version is available. No reply from the vendor...

OrchardCore Cross-Site Scripting Vulnerability

OrchardCore is an open source modular and multi-tenant application framework built using ASP.NET Core, and a content management system CMS built on top of the framework. orchardCore 0.0.1 and later, and versions prior to 1.4.0, is vulnerable to a cross-site scripting vulnerability that stems from...

CVE-2021-35226

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...

CVE-2021-35226

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...

Design/Logic Flaw

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...

CVE-2022-42724

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...

CVE-2022-42724

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...

Information disclosure

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...

CVE-2021-35226 Hashed Credential Exposure Vulnerability

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...

PT-2022-26520

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.164 Description The issue allows attackers to discover role names, which is information that should only be accessible to the site admin. Recommendations For versions prior to 2.4.164, update to version 2.4.164 or...