Critical WordPress Plugin Bug Afflicts 700K Sites

A popular WordPress plugin, which helps make websites compliant with the General Data Protection Regulation GDPR, has issued fixes for a critical flaw. If exploited, the vulnerability could enable attackers to modify content or inject malicious JavaScript code into victim websites. The plugin, GD...

CVE-2020-7910

JetBrains TeamCity before 2019.2 is affected by CVE-2020-7910: a stored XSS vulnerability exploitable by a user with the developer role. The Red Hat entry corroborates the same description. No remediation details are provided in the supplied documents.

wpCentral < 1.4.8 - Privilege Escalation

There’s a vulnerability that allows anyone who is logged in with any user role to escalate their privilege, or alter/upload any file, or adjust any plugin and interact with the site in many other ways. PoC In wpcentral.php, AJAX actions are registered. However, it's only checking whether or not t...

Video on Admin Dashboard < 1.1.4 - Authenticated Stored XSS

Video on Admin Dashboard is vulnerable to stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin's options. PoC A user can insert a simple script in the Widget Title text field, e.g. ". Every specified user role by the plugin will now be targeted by the...

Input validation

SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient checks on the server side...

CVE-2019-15747

CVE-2019-15747 affects SITOS six Build v6.2.1. A user with the Seminar Coordinator role can escalate to System Administrator due to insufficient server-side access checks, enabling privilege escalation. CVSS data in the records shows a high impact (CVSS‑3.1 base score 8.8) but no exploit details ...

CVE-2019-15747

SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient checks on the server side...

WordPress user-role plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. user-role is a plug-in for website user management. A cross-site scripting vulnerability exists in the WordPress user-role plugin...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

Cross site scripting

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues...

CVE-2017-18566

The CVE-2017-18566 affects the WordPress plugin “user-role” by BestWebSoft, specifically versions before 1.5.6. The connected data confirms multiple XSS vulnerabilities (CWE-79) in this plugin, with practical impact: authenticated attackers can inject and execute arbitrary JavaScript in victims’ ...

CVE-2019-1010034

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...

File Manager < 5.2 - Multiple Vulnerabilities

Multiple vulnerabilities exist due to not checking the authentication of the user properly in the wpajax action calls. This results in SQL injection, backup download, backup deletion and backup restoration in the backup feature of the plugin. Authentication is required, but this can be of any use...

Convert Plus Plugin for WordPress < 3.4.3 Arbitrary User Role Creation

The WordPress Convert Plus Plugin installed on the remote host is affected by an unauthenticated arbitrary user role creation vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress ConvertPlus plugin <= 3.4.2 - Unauthenticated Arbitrary User Role Creation vulnerability

Unauthenticated Arbitrary User Role Creation vulnerability found by WordFence in WordPress ConvertPlus plugin versions = 3.4.2. Solution Update the WordPress ConvertPlus plugin to the latest available version at least 3.4.3...

ConvertPlus <= 3.4.2 - Unauthenticated Arbitrary User Role Creation

The convertplug WordPress plugin was affected by an Unauthenticated Arbitrary User Role Creation security vulnerability...

CVE-2019-6617

CVE-2019-6617 describes a privilege-assignment flaw in F5 BIG-IP where a Resource Administrator can overwrite sensitive low-level files (e.g., /etc/passwd) via SFTP without Advanced Shell access. Affected BIG-IP versions include 11.5.2–11.5.8, 11.6.1–11.6.3.4, 12.1.0–12.1.4, 13.0.0–13.1.1.4, and ...

Authorization Bypass

CFME is vulnerable to authorization bypass. User role permissions for actions associated with catalogs are not properly validated, which would allow an authenticated Management Engine user to use this flaw to delete arbitrary catalogs regardless of the granted permissions...