CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37430 – WordPress Patreon WordPress plugin <= 1.9.0 - Image Protection Bypass vulnerability
https://notcve.org/view.php?id=CVE-2024-37430
Authentication Bypass by Spoofing vulnerability in Patreon Patreon WordPress allows Functionality Misuse.This issue affects Patreon WordPress: from n/a through 1.9.0. Vulnerabilidad de omisión de autenticación mediante suplantación de identidad en Patreon Patreon WordPress permite el uso indebido de la funcionalidad. Este problema afecta a Patreon WordPress: desde n/a hasta 1.9.0. The Patreon WordPress plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.9.0. This is due to plugin allowing a bypass when a specific header was supplied. • https://patchstack.com/database/vulnerability/patreon-connect/wordpress-patreon-wordpress-plugin-1-9-0-image-protection-bypass-vulnerability?_s_id=cve • CWE-290: Authentication Bypass by Spoofing CWE-693: Protection Mechanism Failure •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41129 – WordPress Patreon WordPress Plugin <= 1.8.6 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-41129
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Patreon Patreon WordPress. Este problema afecta a Patreon WordPress: desde n/a hasta 1.8.6. The Patreon WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on several functions in the ~/classes/patreon_wordpress.php file. • https://patchstack.com/database/vulnerability/patreon-connect/wordpress-patreon-wordpress-plugin-1-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1CVE-2023-41387
https://notcve.org/view.php?id=CVE-2023-41387
A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of the framework is exposed to the local user if an app uses UIFileSharingEnabled and LSSupportsOpeningDocumentsInPlace properties. As a result, local users can obtain the same attack primitives as remote attackers by tampering with the internal database of the framework on the device. Una inyección SQL en el componente flutter_downloader versión 1.11.1 para iOS permite a los atacantes remotos robar tokens de sesión y sobrescribir archivos arbitrarios dentro del contenedor de la aplicación. La base de datos interna del framework se expone al usuario local si una aplicación usa las propiedades UIFileSharingEnabled y LSSupportsOpeningDocumentsInPlace. • https://pub.dev/packages/flutter_downloader/changelog https://seredynski.com/articles/exploiting-ios-apps-to-extract-session-tokens-and-overwrite-user-data • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25026 – Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25026
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed El plugin Patreon de WordPress versiones anteriores a 1.8.2, no sanea y escapa del campo "Custom Patreon Page name", lo que podría permitir a usuarios con altos privilegios llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html está deshabilitada The Patreon WordPress plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.8.1 due to insufficient privilege handling. This makes it possible for high-privilege users attackers to inject arbitrary web scripts that execute in a victim's browser even when the unfiltered_html capability is disallowed. • https://plugins.trac.wordpress.org/changeset/2682069 https://wpscan.com/vulnerability/02756dd3-832a-4846-b9e1-a34f148b5cfe • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24231 – Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon
https://notcve.org/view.php?id=CVE-2021-24231
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link. El equipo de Jetpack Scan identificó una vulnerabilidad de tipo Cross-Site Request Forgery en el plugin Patreon de WordPress versiones anteriores a 1.7.0, permitiendo a un atacante hacer que un administrador registrado desconecte el sitio de Patreon al visitar un enlace especialmente diseñado • https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin https://wpscan.com/vulnerability/f8ab6855-a319-47ac-82fb-58b181e77500 • CWE-352: Cross-Site Request Forgery (CSRF) •