CVE-2023-2761 User Activity Log < 1.6.3 - Admin+ SQL Injection

The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2023-2761 User Activity Log < 1.6.3 - Admin+ SQL Injection

The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin...

WordPress Plugin User Activity Log SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

User Activity Log < 1.6.5 - Unauthenticated SQLi

Description The plugin does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks. Version 1.6.4 mitigates the issue for unauthenticated users but it is still...

PT-2023-21247 · WordPress · User Activity Log

Name of the Vulnerable Software and Affected Versions: User Activity Log WordPress plugin versions prior to 1.6.3 Description: The issue arises from the improper sanitization and escaping of the txtsearch parameter in SQL statements on certain admin pages, leading to a SQL injection that can be...

WordPress User Activity Log Plugin <= 1.6.2 is vulnerable to SQL Injection

Software User Activity Log Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-37966 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 1ca9ff07b236 Credits LEE SE HYOUNG hackintoanetwork Required privile...

Netwrix Auditor Insecure Object Deserialization Vulnerability

Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP,...

The vulnerability of the User Activity Video Recording component of the Netwrix Auditor software lies in its ability to enable attackers to execute arbitrary code. This vulnerability allows attackers to manipulate IT infrastructure security and control mechanisms.

The vulnerability of the User Activity Video Recording component of the Netwrix Auditor software, which is used for security and IT infrastructure control purposes, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute...

User Activity Log < 1.6.3 - Admin+ SQL Injection

The plugin does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin. PoC As an admin, visit either of the following URL's. Note that it takes several seconds f...

User Activity Log < 1.6.3 - Admin+ SQL Injection

The plugin does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin. As an admin, visit either of the following URL's. Note that it takes several seconds for t...

Imperva Red Team Discovers Vulnerability in TikTok That Can Reveal User Activity and Information

TL;DR The Imperva Red Team discovered a vulnerability in TikTok, a popular social media platform with more than one billion users worldwide, that could allow attackers to monitor users activity on both mobile and desktop devices. This vulnerability, which has now been fixed, was caused by a windo...

WordPress User Activity Plugin <= 1.0.1 is vulnerable to Content Spoofing

Software User Activity Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Content Spoofing CVE CVE-2022-4550 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ff21fa6bc6ad Credits rezaduty Required privilege...

CVE-2021-46841

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.5.0 for Android. An attacker in a privileged network position can track a user's activity...

CVE-2022-4550 User Activity <= 1.0.1 - IP Spoofing

The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

CVE-2022-4550

CVE-2022-4550 concerns the WordPress plugin “User Activity” up to version 1.0.1. The vulnerability arises because the plugin checks HTTP headers such as X-Forwarded-For to obtain the request IP address, which can allow IP spoofing. The documented impact (per NVD) indicates a high severity (CVSS v...

WordPress plugin User Activity 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Apple Music 安全漏洞

Apple Music is a music program by the American company Apple Apple. A security vulnerability exists in Apple Music versions prior to 3.5.0. An attacker exploiting the vulnerability could track user activity...

CVE-2021-46841

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.5.0 for Android. An attacker in a privileged network position can track a user's activity...

Finding forensics breadcrumbs in Android image storage

Introduction Our digital forensics work is wide and varied. Often there’s very little that we can talk about in the public domain, so when I find something that we can share I get a bit excited. In this post I’ll be talking about image scanning apps, and how to reverse engineer them to pinpoint...

SUSE CVE-2018-5179

A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60...