2017 matches found
Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure
The theme allows unauthenticated users to manipulate the queryvars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request. POST /wp-json/csco/v1/more-posts Accept:...
CVE-2021-42054
ACCEL-PPP 1.12.0 has an out-of-bounds read in tritoncontextschedule if the client exits after authentication...
CVE-2021-42054
ACCEL-PPP 1.12.0 has an out-of-bounds read in tritoncontextschedule if the client exits after authentication...
Accel-Ppp 缓冲区错误漏洞
Accel-Ppp is a high performance Pptp/L2tp/Pppoe/Ipoe server for Linux. ACCEL-PPP 1.12.0 suffers from a security vulnerability that originates from a read out-of-bounds in tritoncontextschedule. An attacker can exploit the vulnerability to obtain sensitive information...
PT-2021-23492
Name of the Vulnerable Software and Affected Versions ACCEL-PPP version 1.12.0 Description The issue is an out-of-bounds read in the triton context schedule function that occurs when the client exits after authentication. Recommendations For ACCEL-PPP version 1.12.0, consider disabling the triton...
JobSearch WP Job Board < 1.8.2 - Subscriber+ Add/Update Schedule Calls
The jobsearchaddjobimportschedulecall and jobsearchupdatejobimportschedulecall AJAx action o the plugin, available to any authenticated user do not have authorisation and CSRF check sin place, allowing users with a role as low as subscriber to call them...
CVE-2021-24585
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts...
CVE-2021-24584
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the editposts capability contributor+ to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...
Default credentials
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts...
CVE-2021-24583
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the editposts capability contributor+ to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...
CVE-2021-24584
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the editposts capability contributor+ to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...
CVE-2021-24585
CVE-2021-24585 affects the WordPress Timetable and Event Schedule by MotoPress plugin prior to 2.4.0. The vulnerability leaks hashed passwords, usernames, and email addresses (and other less sensitive data) in responses for event timeslot data when requested by a user with edit_posts. Combined wi...
CVE-2021-24583
The Timetable and Event Schedule WordPress plugin by MotoPress (versions prior to 2.4.2) has a vulnerability where deleting a timeslot lacks proper access control and CSRF protection. Any user with the edit_posts capability (contributor+) can delete arbitrary timeslots from any event. The issue i...
PT-2021-16101
Name of the Vulnerable Software and Affected Versions The Timetable and Event Schedule WordPress plugin versions prior to 2.4.0 Description The issue allows low-privilege users with the edit posts capability to retrieve sensitive user data, including hashed passwords, usernames, and email...
WordPress Plugin Timetable and Event Schedule 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2021-16100 · WordPress · Timetable/Event Schedule
Name of the Vulnerable Software and Affected Versions: Timetable and Event Schedule WordPress plugin versions prior to 2.4.2 Timetable and Event Schedule WordPress plugin versions prior to 2.3.19 Description: The issue concerns a lack of proper access control when updating timeslots, allowing any...
WordPress 插件信息泄露漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on servers running PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. An information disclosure vulnerability exists in the...
WordPress Plugin Timetable and Event Schedule 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2021-24583: Improper Access Control
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the editposts capability contributor+ to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...
CVE-2021-24585: Exposure of Sensitive Information to an Unauthorized Actor
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts...