The Newsmatic theme for WordPress does not sufficiently escape the 'slug' parameter and does not use prepared SQL statements. An unauthenticated attacker can append SQL queries to existing database queries over the network. This can be used to extract sensitive information from the database, such as user accounts and password hashes, on any public site running the affected theme.
blazethemes · Newsmatic
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The installer of Yamaha LAN Monitor for Windows up to version 1.9.3 loads Dynamic Link Libraries from an insecure search path. If the installer is started from a directory containing a specially crafted DLL, the DLL is loaded and code runs with administrative privileges. The attacker must place the file locally and the user must run the installer; the issue affects only installation and not already installed copies.
Yamaha Corporation · Yamaha LAN Monitor for Windows
Research and translation in progress – available shortly.
Two OS command injection vulnerabilities in the update installation function of Nozomi Networks Guardian and CMC allow arbitrary commands to run with root privileges. The cause is insufficient validation of update bundle contents. An attacker needs administrative privileges and must get a crafted update bundle installed, for example via the web management interface. Successful exploitation allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.
Nozomi Networks · Guardian and CMC
Nozomi Networks Guardian and Central Management Console (CMC) before version 26.4.0 contain a flaw in update bundle validation. An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but runs an unsigned script with root privileges during installation. This allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.
Nozomi Networks · Guardian/CMC
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The WordPress plugin Login with phone number up to and including version 1.8.78 contains a broken authentication flaw (CWE-1390, CVSS 8.8 per the CNA). According to Patchstack, an attacker can bypass the login system or log in as other users without their password. Patchstack lists the required privilege as Subscriber, so a low-privilege account may be needed, but the exact precondition is not confirmed.
Hamid Alinia · Login with phone number
The WordPress plugin BuddyPress contains a blind SQL injection vulnerability (CWE-89) in versions up to and including 14.5.2. An authenticated attacker with a low-privilege account can inject SQL commands and extract database content, including user accounts and private data, although this is slow and requires many requests. Patchstack rates the issue as high priority with a CVSS score of 8.5, while VulDB gives 6.3; the NVD analysis is still pending.
WordPress BuddyPress · BuddyPress
The Motors - Car Dealership & Classified Listings WordPress plugin up to and including 1.4.126 contains a blind SQL injection vulnerability (CWE-89). An unauthenticated remote attacker can send crafted requests to read, modify or delete database contents, including user accounts and private data. Patchstack rates the issue as high priority with a CVSS score of 9.3.
StylemixThemes · Motors
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
LearnPress, a WordPress plugin for creating and selling online courses, contains a missing authorization flaw (CWE-862) in versions up to and including 4.4.11. An unauthenticated remote attacker may be able to access functions or data they should not see, such as other users' information. The CVSS base score is 7.5 with a high impact on confidentiality only; the vulnerable endpoint is not described in the sources, and VulDB rates the issue lower (5.3).
ThimPress · LearnPress
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The WordPress plugin GEO my WordPress (geo-my-wp) in versions up to and including 4.5.5.5 lacks proper authorization checks. According to the CNA, an unauthenticated remote attacker may be able to access functions or data they should not reach, with a high confidentiality impact. Exposure depends on a publicly reachable WordPress site running the affected plugin.
Eyal Fitoussi · GEO my WordPress
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
