RSS   Podatności dla 'Simple download monitor'   RSS

2022-03-14
 
CVE-2021-24692

CWE-22
 
 
The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector.

 
2022-01-24
 
CVE-2021-24694

CWE-79
 
 
The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) "color" or "css_class" argument of sdm_download shortcode, 2) "class" or "placeholder" argument of sdm_search_form shortcode.

 
 
CVE-2021-24696

CWE-352
 
 
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads

 
2021-11-08
 
CVE-2021-24693

CWE-79
 
 
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin

 
 
CVE-2021-24695

CWE-200
 
 
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames

 
 
CVE-2021-24697

CWE-79
 
 
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

 
 
CVE-2021-24698

NVD-CWE-noinfo
 
 
The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.

 
2020-10-21
 
CVE-2020-5651

CWE-89
 
 
SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL.

 
 
CVE-2020-5650

CWE-79
 
 
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.

 

 >>> Vendor: Tipsandtricks-hq 12 Produkty
Wordpress simple paypal shopping cart
Simple download monitor
All in one wp security & firewall
Category specific rss feed subscription
Wp security \& firewall
Software license manager
Wp video lightbox
Compact wp audio player
Far future expiry header
All in one wp security \& firewall
Wp simple adsense insertion
Accept stripe

Copyright 2024, cxsecurity.com

 

Back to Top