45 matches found
CVE-2022-4417 WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users...
CVE-2022-4417
CVE-2022-4417 affects the WordPress plugin WP Cerber Security, Anti-spam & Malware Scan older than 9.3.3. The issue is improper access control of the REST API users endpoint when the blog is hosted in a subdirectory, enabling potential user enumeration. The practical impact is limited to informat...
WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API
The plugin does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users When the "Block access to users' data via REST API" settings is enabled...
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure vulnerability exists in WordPress WP Cerber Security 9.0 and prior versions, which stems from incorrect validation of the value provided for the author parameter in the ~/cerber-load.php file. An attacker can exploit the vulnerability to launch a user enumeration attack.
FlyteAdmin is a control plane for Flyte open source. Responsible for managing entities tasks, workflows, startup plans and managing workflow execution. An information disclosure vulnerability exists in Flyte FlyteAdmin versions prior to 1.1.44, which stems from the fact that users who enable the...
CVE-2022-2939
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the /cerber-load.php file. In...
CVE-2022-2939 WP Cerber Security <= 9.0 - User Enumeration Bypass
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the /cerber-load.php file. In...
CVE-2022-2939
CVE-2022-2939 affects the WP Cerber Security plugin for WordPress up to version 9.0. The vulnerability arises from improper validation of the author parameter in cerber-load.php, where non-numeric input can bypass the numeric-only protection, enabling user enumeration by unauthenticated attackers...
WordPress WP Cerber Security, Anti-spam & Malware Scan Plugin < 8.9.6 XSS Vulnerability
The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
CVE-2022-0429 WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability...
CVE-2022-0429
CVE-2022-0429 affects the WordPress plugin “WP Cerber Security, Anti-spam & Malware Scan”
WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting
The plugin does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability. PoC POST /"/onmouseover=alert1;// HTTP/1.1 Host: 127.0.0.1 Content-Type:...
CVE-2021-37597
WP Cerber before 8.9.3 allows MFA bypass via wordpressloggedinhash manipulation...
CVE-2021-37598
WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character...
Design/Logic Flaw
WP Cerber before 8.9.3 allows MFA bypass via wordpressloggedinhash manipulation...
Authentication flaw
WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character...
CVE-2021-37597
WP Cerber before 8.9.3 allows MFA bypass via wordpressloggedinhash manipulation...
CVE-2021-37597
CVE-2021-37597 affects WordPress WP Cerber plugin versions prior to 8.9.3, where MFA can be bypassed by manipulating the wordpress_logged_in_[hash] value. The issue is described in multiple sources as a 2FA bypass vulnerability with high impact. A fix is available in version 8.9.3 and later; upgr...
CVE-2021-37597
WP Cerber before 8.9.3 allows MFA bypass via wordpressloggedinhash manipulation...
CVE-2021-37598
WP Cerber before 8.9.3 has a broken access control in the /wp-json endpoint caused by improper handling of a trailing ? character, allowing unauthorized access to protected REST API endpoints. Affected software: WP Cerber versions prior to 8.9.3. The root cause is a bypass of the access control f...