5208 matches found
CVE-2018-0585: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-0587: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors...
PT-2018-8943
Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.0.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For Ultimate Member plugin versions prior to 2.0.4, update to version 2.0.4...
PT-2018-8948
Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.0.4 Description The issue allows remote authenticated attackers to bypass access restrictions and modify other users' profiles. Recommendations For versions prior to 2.0.4, update to version 2.0.4 or...
PT-2018-8945
Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.0.4 Description The issue allows remote authenticated users to upload arbitrary image files. Recommendations For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue...
PT-2018-8946
Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.0.4 Description The issue allows remote attackers to read arbitrary files via unspecified vectors due to a directory traversal vulnerability in the AJAX function. Recommendations For versions prior to...
PT-2018-8947
Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.0.4 Description The issue allows remote authenticated attackers to bypass access restrictions, enabling them to add a new form in the 'Forms' page. Recommendations For versions prior to 2.0.4, update ...
CVE-2018-0586: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors...
CVE-2018-0588: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors...
Multiple vulnerabilities in WordPress plugin "Ultimate Member"
Overview The WordPress plugin "Ultimate Member" provided by Ultimate Member contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2018-0585 Directory Traversal in the shortcodes function CWE-22 - CVE-2018-0586 Arbitrary File Upload CWE-434 - CVE-2018-0587 Directory...
Ultimate Member < 2.0.4 - Multiple Issues
XSS, Directory Traversal, Arbitrary File Upload, Access restriction Bypass...
JVN#28804532: Multiple vulnerabilities in WordPress plugin "Ultimate Member"
The WordPress plugin "Ultimate Member" provided by Ultimate Member contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2018-0585 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVSS v2|...
CVE-2018-10256
A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query...
CVE-2018-10260
A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...
CVE-2018-10256
A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query...
CVE-2018-10257
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...
Input validation
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution...
Cross site scripting
An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...
