PT-2022-7190 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: Essential Real Estate WordPress plugin versions prior to 3.9.6 Description: The issue is related to the lack of sanitization and escaping of some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting...

Sql injection

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...

Researchers Detail AppSync Cross-Tenant Vulnerability in Amazon Web Services

Amazon Web Services AWS has resolved a cross-tenant vulnerability in its platform that could be weaponized by an attacker to gain unauthorized access to resources. The issue relates to a confused deputy problem, a type of privilege escalation where a program that doesn't have permission to perfor...

CVE-2022-45932

A SQL injection issue was discovered in AAA in OpenDaylight ODL before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected when the API interface /auth/v1/roles/ is used...

WordPress WP User Frontend Authorization Issue Vulnerability

WP User Frontend is a wordpress plugin for user frontend posting and submission. An authorization issue vulnerability exists in WordPress WP User Frontend versions prior to 3.5.29. The vulnerability stems from improper privilege management and can be exploited by an attacker to create accounts wi...

Booster for WooCommerce - Custom Role Creation/Deletion via CSRF

The plugins does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks PoC To delete the custom role dj it's possible to delete roles created by other plugins, make a logged in admi...

Rocky Linux-system-roles bug fix and enhancement update

An update is available for rhel-system-roles. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Rocky Linux-system-roles-sap bug fix and enhancement update

An update is available for rhel-system-roles-sap. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

GHSA-PCPM-VC4V-CMVX eZ Platform users with the Company admin role can assign any role to any user

Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...

CVE-2022-40206 WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public...

Rocky Linux-system-roles bug fix and enhancement update

An update is available for rhel-system-roles. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

ansible-freeipa bug fix and enhancement update

An update is available for ansible-freeipa. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The ansible-freeipa package provides Ansible roles and playbooks to...

Rocky Linux-system-roles-sap bug fix and enhancement update

An update is available for rhel-system-roles-sap. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Rocky Linux-system-roles-sap package provides Rocky Linux...

CVE-2022-3419

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator...

CVE-2022-3419

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator...

Cross site request forgery (csrf)

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator...

WordPress plugin Automatic User Roles Switcher 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in the WordPress...

CVE-2022-3419

CVE-2022-3419 affects the WordPress plugin Automatic User Roles Switcher (versions prior to 1.1.2). The root cause is missing authorization checks and CSRF protections, enabling any authenticated user (e.g., subscriber) to grant themselves higher privileges, including administrator. According to ...

PT-2022-22058 · WordPress · Automatic User Roles Switcher

Name of the Vulnerable Software and Affected Versions: Automatic User Roles Switcher WordPress plugin versions prior to 1.1.2 Description: The issue concerns a lack of proper authorization and CSRF checks, allowing authenticated users, such as subscribers, to add any role to themselves, including...

CVE-2022-3419 Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator...