Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
stem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/usn/usn-4183-1 - https://usn.ubuntu.com/usn/usn-4184-1 - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=5df147c8140efc71ac0879ae3b0057f577226d4c
CVE ID: CVE-2019-15793 State: PUBLISHED Published: 2020-04-23T23:55:24.581625Z Last Updated: 2024-09-16T16:58:57.384Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Ubuntu Products: Shiftfs in the Linux kernel Problem Types: CWE-538 Description: In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whereas they should have been translated into the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, whic
to the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, which likely did not map into the shifts s_user_ns. A local attacker could use this to possibly bypass discretionary access control permissions. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/usn/usn-4183-1 - https://usn.ubuntu.com/usn/usn-4184-1 - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=3644b9d5688da86f18e017c9c580b75cf52927bb
CVE ID: CVE-2019-15794 State: PUBLISHED Published: 2020-04-23T23:55:25.039982Z Last Updated: 2024-09-16T19:52:18.313Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Ubuntu Products: Linux kernel Problem Types: CWE-672 Description: Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patc
is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow. Additional Analyst Notes: - CVE Program Container: References: - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635 - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3 - https://usn.ubuntu.com/usn/usn-4208-1 - https://usn.ubuntu.com/usn/usn-4209-1
CVE ID: CVE-2019-15795 State: PUBLISHED Published: 2020-03-26T13:00:21.299320Z Last Updated: 2024-09-16T19:45:50.191Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Canonical Products: Python-apt Problem Types: CWE-327 Description: python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5. Additional Analyst Notes: - CVE Pr
1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4247-1/ - https://usn.ubuntu.com/4247-3/
CVE ID: CVE-2019-15796 State: PUBLISHED Published: 2020-03-26T13:00:21.745369Z Last Updated: 2024-09-16T22:14:45.095Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Canonical Products: Python-apt Problem Types: CWE-287 Description: Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5. Additional Analys
, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4247-1/ - https://usn.ubuntu.com/4247-3/
CVE ID: CVE-2019-15797 State: REJECTED Published: N/A Last Updated: 2024-06-20T23:58:12.685Z Description: No description available.
CVE ID: CVE-2019-15798 State: REJECTED Published: N/A Last Updated: 2024-06-20T23:58:43.418Z Description: No description available.
CVE ID: CVE-2019-15799 State: PUBLISHED Published: 2019-11-14T20:16:33 Last Updated: 2024-08-05T00:56:22.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the devi
assword by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the device. As these passwords are encrypted using well-known and static parameters, they can be decrypted and the original passwords (including the administrator password) can be obtained. Additional Analyst Notes: - CVE Program Container: References: - https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html - https://vimeo.com/354726424 - https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
CVE ID: CVE-2019-15800 State: PUBLISHED Published: 2019-11-14T20:16:20 Last Updated: 2024-08-05T00:56:22.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vuln
ot called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.) Additional Analyst Notes: - CVE Program Container: References: - https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html - https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
CVE ID: CVE-2019-15801 State: PUBLISHED Published: 2019-11-14T20:16:08 Last Updated: 2024-08-05T00:56:22.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://jasper.la/exploring-z
d_ret() in libfds.so.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html - https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
CVE ID: CVE-2019-15802 State: PUBLISHED Published: 2019-11-14T20:16:03 Last Updated: 2024-08-05T00:56:22.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware. Additional Analys
es the passwords that are part of configuration backups or otherwise embedded as part of the firmware. Additional Analyst Notes: - CVE Program Container: References: - https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html - https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
CVE ID: CVE-2019-15803 State: PUBLISHED Published: 2019-11-14T20:15:56 Last Updated: 2024-08-05T00:56:22.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return TRUE with no actual
y. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return TRUE with no actual checks performed. The diagnostics menu allows for reading/writing arbitrary registers and various other configuration parameters which are believed to be related to the network interface chips. Additional Analyst Notes: - CVE Program Container: References: - https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html - https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
CVE ID: CVE-2019-15804 State: PUBLISHED Published: 2019-11-14T20:15:46 Last Updated: 2024-08-05T00:56:22.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+\ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains "Password recovery for specific user" options. The menu is believed to be accessible using a serial console. Additional Analyst Notes: - CVE Pro
pecific user" options. The menu is believed to be accessible using a serial console. Additional Analyst Notes: - CVE Program Container: References: - https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html - https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
CVE ID: CVE-2019-15805 State: PUBLISHED Published: 2019-08-29T17:21:59 Last Updated: 2024-08-05T00:56:22.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40v.roberthoutenbrink/commscope-vulnerability-authentication-bypass-in-arris-tr4400-firmware-version-a1-00-004-180301-4a90aa8e7570
CVE ID: CVE-2019-15806 State: PUBLISHED Published: 2019-08-29T17:21:43 Last Updated: 2024-08-05T00:56:22.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basic_sett.html. Any user connected to the Wi-Fi can exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40v.roberthoutenbrink/commscope-vulnerability-authentication-bypass-in-arris-tr4400-firmware-version-a1-00-004-180301-4a90aa8e7570
CVE ID: CVE-2019-15807 State: PUBLISHED Published: 2019-08-29T17:32:06 Last Updated: 2024-08-05T00:56:22.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0541791453fbe7f42867e310e0c9eb6295364d - https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html - https://lists.debian.org/debian-lts-
c9eb6295364d - https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html - https://security.netapp.com/advisory/ntap-20191004-0001/ - https://support.f5.com/csp/article/K52136304?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-15809 State: PUBLISHED Published: 2019-10-03T13:17:24 Last Updated: 2024-08-05T00:56:22.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because the Atmel Toolbox 00.03.11.05 contains two versions of ECDSA signature functions, described as fast and secure, but the affected cards chose to use the fast version, which leaks the bit length of the
s, described as fast and secure, but the affected cards chose to use the fast version, which leaks the bit length of the random nonce via timing. This affects Athena IDProtect 010b.0352.0005, Athena IDProtect 010e.1245.0002, Athena IDProtect 0106.0130.0401, Athena IDProtect 010e.1245.0002, Valid S/A IDflex V 010b.0352.0005, SafeNet eToken 4300 010e.1245.0002, TecSec Armored Card 010e.0264.0001, and TecSec Armored Card 108.0264.0001. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2011/232.pdf - https://tches.iacr.org/index.php/TCHES/article/view/7337 - https://www.ssi.gouv.fr/certification_cc/bibliotheque-cryptographique-atmel-toolbox-00-03-11-05/ - h
article/view/7337 - https://www.ssi.gouv.fr/certification_cc/bibliotheque-cryptographique-atmel-toolbox-00-03-11-05/ - https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/details?source=ECDSA&number=214 - http://www.openwall.com/lists/oss-security/2019/10/02/2 - https://minerva.crocs.fi.muni.cz/
CVE ID: CVE-2019-15810 State: PUBLISHED Published: 2019-09-30T16:03:06 Last Updated: 2024-08-05T00:56:22.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netdisco/netdisco/commits/master - https://github.com/netdisco/netdisco/commit/deb9b62c7f839f5e41aa4d620bcdac5f9321a8a3
CVE ID: CVE-2019-15811 State: PUBLISHED Published: 2019-08-29T18:58:58 Last Updated: 2024-08-05T00:56:22.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/108 - https://zerodays.lol/ - http://packetstormsecurity.com/files/154270/DomainMod-4.13-Cross-Site-Scripting.html
CVE ID: CVE-2019-15813 State: PUBLISHED Published: 2019-09-04T13:44:47 Last Updated: 2024-08-05T00:56:22.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47323 - http://packetstormsecurity.com/files/159712/Sentrifugo-3.2-Shell-Upload-Restriction-Bypass.html
CVE ID: CVE-2019-15814 State: PUBLISHED Published: 2019-09-04T13:50:05 Last Updated: 2024-08-05T00:56:22.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47324
CVE ID: CVE-2019-15815 State: PUBLISHED Published: 2019-11-12T17:05:40 Last Updated: 2024-08-05T00:56:22.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/P1302-T10D-v3-modem-insecure-direct-object-reference-vulnerability.shtml
CVE ID: CVE-2019-15816 State: PUBLISHED Published: 2019-08-30T12:28:13 Last Updated: 2024-08-05T00:56:22.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9817 - https://wordpress.org/plugins/wp-private-content-plus/#developers - https://blog.nintechnet.com/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-content-plus-plugin/
CVE ID: CVE-2019-15817 State: PUBLISHED Published: 2019-08-30T12:30:26 Last Updated: 2024-08-05T00:56:22.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: The easy-property-listings plugin before 3.4 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9511 - https://wordpress.org/plugins/easy-property-listings/#developers
CVE ID: CVE-2019-15818 State: PUBLISHED Published: 2019-08-30T12:32:43 Last Updated: 2024-08-05T00:56:22.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9503 - https://wordpress.org/plugins/simple-301-redirects-addon-bulk-uploader/#developers - https://blog.nintechnet.com/unauthenticated-option-changes-in-wordpress-simple-301-redirects-addon-bulk-uploader-plugin/
CVE ID: CVE-2019-15819 State: PUBLISHED Published: 2019-08-30T12:37:36 Last Updated: 2024-08-05T00:56:22.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9501 - https://wordpress.org/plugins/nd-restaurant-reservations/#developers - https://blog.nintechnet.com/privilege-escalation-vulnerability-in-wordpress-nd-restaurant-reservations-plugin/
CVE ID: CVE-2019-15820 State: PUBLISHED Published: 2019-08-30T12:39:14 Last Updated: 2024-08-05T00:56:22.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9500 - https://wordpress.org/plugins/login-or-logout-menu-item/#developers - https://blog.nintechnet.com/unauthenticated-options-change-in-wordpress-login-or-logout-menu-item-plugin/
CVE ID: CVE-2019-15821 State: PUBLISHED Published: 2019-08-30T12:41:07 Last Updated: 2024-08-05T00:56:22.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9703 - https://wordpress.org/plugins/bold-page-builder/#developers - https://blog.nintechnet.com/critical-vulnerability-in-wordpress-bold-page-builder-plugin-currently-being-exploited/
CVE ID: CVE-2019-15822 State: PUBLISHED Published: 2019-08-30T12:42:35 Last Updated: 2024-08-05T00:56:22.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9470 - https://wordpress.org/plugins/wps-child-theme-generator/#developers - https://secupress.me/blog/wps-child-theme-generator-v1-1-multiples-vulnerabilities/
CVE ID: CVE-2019-15823 State: PUBLISHED Published: 2019-08-30T12:49:10 Last Updated: 2024-08-05T00:56:22.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9469 - https://wordpress.org/plugins/wps-hide-login/#developers - https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/
CVE ID: CVE-2019-15824 State: PUBLISHED Published: 2019-08-30T12:57:19 Last Updated: 2024-08-05T00:56:22.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9469 - https://wordpress.org/plugins/wps-hide-login/#developers - https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/
CVE ID: CVE-2019-15825 State: PUBLISHED Published: 2019-08-30T12:58:11 Last Updated: 2024-08-05T00:56:22.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9469 - https://wordpress.org/plugins/wps-hide-login/#developers - https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/
CVE ID: CVE-2019-15826 State: PUBLISHED Published: 2019-08-30T12:59:08 Last Updated: 2024-08-05T00:56:22.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9469 - https://wordpress.org/plugins/wps-hide-login/#developers - https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/