36 matches found
CVE-2023-2546 WP User Switch <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie
The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpusallowusertoadminbarmenu' function with the 'wpuswhoswitch' cookie value. This makes it possible for authenticated...
CVE-2023-2546 WP User Switch <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie
The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpusallowusertoadminbarmenu' function with the 'wpuswhoswitch' cookie value. This makes it possible for authenticated...
WordPress plugin WP User Switch 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WP User Switch < 1.0.3 - Subscriber+ Authentication Bypass
The plugin does not properly verify the 'wpuswhoswitch' cookie value, which allows attackers with low-privilege accounts like Subscribers to bypass authentication and login as any other existing user. PoC Log-in as a subscriber onto the affected site. Run the following JS script in your browser's...
WP User Switch < 1.0.3 - Subscriber+ Authentication Bypass
The plugin does not properly verify the 'wpuswhoswitch' cookie value, which allows attackers with low-privilege accounts like Subscribers to bypass authentication and login as any other existing user. Log-in as a subscriber onto the affected site. Run the following JS script in your browser's...
WordPress WP User Switch Plugin <= 1.0.2 is vulnerable to Bypass Vulnerability
Software WP User Switch Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.0.3 OWASP Top 10 A2: Broken Authentication Classification Bypass Vulnerability CVE CVE-2023-2546 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID d69f4769545f Credits István Márton Required privile...
Apple macOS Big Sur和Apple macOS Monterey授权问题漏洞
Apple macOS Big Sur and Apple macOS Monterey are both products of Apple Inc.Apple macOS Big Sur is a mobile application app.Apple macOS Monterey is the 18th major version of macOS, the operating system for the Macintosh desktop. An authorization issue vulnerability exists in Apple macOS Big Sur a...
UBUNTU-CVE-2021-21424
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. ...
openSUSE Security Update : gnome-shell (openSUSE-2017-974)
This update for gnome-shell provides the following fixes : - Fix not intuitive login screen for root user bsc1047262 - Disable session selection button when it's hidden in user switch dialog bsc1034584, bsc1034827 - Fix app windows overlay app list in overview screen bsc1008539 - Properly handle...
CVE-2012-1085
Unspecified vulnerability in the BE User Switch beuserswitch extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in the BE User Switch beuserswitch extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-1085
Unspecified vulnerability in the BE User Switch beuserswitch extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors...
CVE-2012-1085
Technical details about CVE-2012-1085 are not provided in the supplied documents beyond a generic description of an unspecified vulnerability in the TYPO3 BE User Switch extension; monitor for updates.
CVE-2012-1084
The CVE-2012-1084 entry concerns TYPO3’s BE User Switch (beuserswitch) extension version 0.0.1, where an XSS vulnerability could allow remote attackers to inject arbitrary script or HTML via unspecified vectors. The available documents identify the affected software and vulnerability type but do ...