Max Boll

تسمح هذه الثغرة للمهاجمين غير المصادق عليهم بالتحايل على «التحقق الرياضي المدمج» (Mathematical CAPTCHA)، مما يتيح لهم التحايل على حماية CAPTCHA. وهذه ثغرة تتعلق بتجاوز نظام CAPTCHA.

يتأثر المكون الإضافي BuddyForms لـ WordPress بثغرة أمنية من نوع Cross-Site Scripting (XSS) المخزنة بسبب عدم كفاية عملية تنقية المدخلات وتهريب المخرجات في السمات التي يقدمها المستخدم في الرمز المختصر `buddyforms nav`. وهذا يسمح للمهاجمين المصادق عليهم الذين يتمتعون بوصول على مستوى «المساهم» أو أعلى بحقن نصوص برمجية ويب تعسفية في الصفحات، والتي سيتم تنفيذها كلما قام مستخدم بالوصول إلى صفحة تم حقنها.

تتعلق المشكلة بـ ”التنفيذ البرمجي عبر المواقع المخزّن“ (Stored Cross-Site Scripting) عبر الرمز المختصر ’bf new submission link‘ الخاص بالمكوّن الإضافي، وذلك بسبب عدم كفاية عملية تنقية المدخلات وتهريب المخرجات في السمات التي يقدمها المستخدم. وهذا يسمح للمهاجمين المصادق عليهم الذين يتمتعون بحق الوصول على مستوى «المساهم» أو أعلى بإدخال نصوص برمجية ويب تعسفية في الصفحات، والتي سيتم تنفيذها كلما قام مستخدم بالوصول إلى صفحة تم إدخال النص البرمجي فيها.

The issue arises because the plugin does not utilize a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts.

The issue allows unauthenticated attackers to perform SQL Injection via the `orderby` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database. The attack requires an unauthenticated user to have permission to view form submissions, and the form submission shortcode must be added to a page.

The issue is related to unlimited height and width parameters for CAPTCHA images, allowing unauthenticated attackers to send multiple requests with large values. This results in slowing server resources if the server does not mitigate Denial of Service attacks. The attackers can exploit this by sending requests with large values for the height and width parameters of the CAPTCHA images.

The issue is related to Stored Cross-Site Scripting via submission forms due to insufficient input sanitization and output escaping on the new Taxonomy form. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation is only possible when lower-level users have been granted access to submit specific forms, which is disabled by default.

The issue is due to insufficient controls on the `Role` field in a form, allowing unauthenticated attackers to create new administrative user accounts. This vulnerability affects the Frontend Admin by DynamiApps plugin for WordPress, making it possible for attackers to escalate privileges even when the administrative user role has not been provided as an option to the user, granted that unauthenticated users have been provided access to the form.

The issue is related to Stored Cross-Site Scripting via the `provider name` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping, making it possible for unauthenticated attackers to inject arbitrary web scripts in pages. This can be achieved by tricking a user into performing an action, such as clicking on a link, allowing attackers to execute arbitrary web scripts. The `shipping method filter` parameter is specifically vulnerable to Reflected Cross-Site Scripting.

The issue is related to Reflected Cross-Site Scripting via URLs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue allows unauthenticated attackers to extract sensitive data, such as redirects including GET parameters, via the export feature. This could potentially reveal sensitive information.

The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the file.

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery via the `ce get file()` function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

The issue is due to the plugin not properly neutralizing HTML elements from submitted forms, making it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.

The issue is related to Stored Cross-Site Scripting via the table cell content due to insufficient input sanitization and output escaping. This allows authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.