WordPress DD Roles plugin <= 4.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Mika in WordPress Plugin DD Roles versions = 4.1...

WordPress plugin DD Roles 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

K000149289: Apache Traffic Control vulnerability CVE-2024-45387

Security Advisory Description An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request...

CVE-2024-11606

The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-11357

The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Privilege Escalation

Drupal Core is vulnerable to Privilege Escalation. The vulnerability is due to improper validation of user roles and permissions, which allows unauthorized users to bypass access restrictions and gain elevated privileges...

CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrad...

CVE-2024-56351

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles...

CVE-2024-56351

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles...

CVE-2024-56351

CVE-2024-56351 affects JetBrains TeamCity prior to version 2024.12. The root issue is that access tokens were not revoked after removing user roles, potentially allowing unauthorized access to tokens tied to former roles. The vulnerability is scoped to TeamCity’s authentication/session handling a...

CVE-2024-56351

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles...

CVE-2024-56351

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles...

PT-2024-9852 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12 Description: The issue is related to the incorrect session expiration in the JetBrains TeamCity CI/CD system. Exploitation of this issue may allow a remote attacker to impact the confidentiality,...

WordPress plugin Maintenance & Coming Soon Redirect Animation 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An access control error vulnerability exists i...

PT-2024-39664 · WordPress · Maintenance & Coming Soon Redirect Animation

Name of the Vulnerable Software and Affected Versions: Maintenance & Coming Soon Redirect Animation plugin for WordPress versions up to, and including, 2.1.3 Description: The issue is related to unauthorized modification of data due to a missing capability check on the wploti add whitelisted role...

CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...

Important: postgresql

Issue Overview: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query...

PT-2024-35385 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user...

WordPress plugin User Role Editor 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

CVE-2023-41130

Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through = 1.0.12...