Sergej Ljubojevic

Nome do Software Vulnerável e Versões Afetadas GitHub Enterprise Server versões anteriores à 3.20 GitHub Enterprise Server versões 3.16.15 a 3.16.15 GitHub Enterprise Server versões 3.17.12 a 3.17.12 GitHub Enterprise Server versões 3.18.6 a 3.18.6 GitHub Enterprise Server versões 3.19.3 a 3.19.3 Descrição Um problema de autorização incorreta foi identificado no GitHub Enterprise Server. Um usuário autenticado com um token de acesso pessoal clássico (PAT) que não possui o escopo `repo` poderia recuperar issues e commits de repositórios privados e internos. Isso era possível por meio dos endpoints da API REST de busca. O usuário precisava ter acesso existente ao repositório por meio de associação à organização ou como colaborador para que a exploração ocorresse. Os endpoints da API afetados são a API REST de busca. A variável vulnerável é o token de acesso pessoal clássico (PAT). Recomendações Atualize o GitHub Enterprise Server para a versão 3.20 ou posterior. Atualize o GitHub Enterprise Server para a versão 3.16.15. Atualize o GitHub Enterprise Server para a versão 3.17.12. Atualize o GitHub Enterprise Server para a versão 3.18.6. Atualize o GitHub Enterprise Server para a versão 3.19.3.

**Name of the Vulnerable Software and Affected Versions** ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to and including 5.9.8.1 **Description** The ProfileGrid plugin for WordPress is affected by an issue allowing unauthorized message deletion. This occurs because the `pg delete msg()` function lacks a proper capability check, enabling authenticated attackers with Subscriber-level access or higher to delete messages belonging to any user. Exploitation involves sending a direct request with a valid message ID through the `mid` parameter. **Recommendations** Update ProfileGrid – User Profiles, Groups and Communities plugin for WordPress to a version later than 5.9.8.1.

**Name of the Vulnerable Software and Affected Versions** ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to and including 5.9.8.2 **Description** The ProfileGrid plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is a result of a lack of nonce validation on the membership request management page, specifically during approve and decline actions. An unauthenticated attacker can potentially approve or deny group membership requests by tricking a site administrator into performing an action, such as clicking a malicious link. The affected functionality involves the processing of membership requests. **Recommendations** Update ProfileGrid – User Profiles, Groups and Communities plugin for WordPress to a version later than 5.9.8.2.

**Name of the Vulnerable Software and Affected Versions** The Newsletter – Send awesome emails from WordPress plugin versions prior to 9.1.1 **Description** The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by insufficient or incorrect nonce validation within the `hook newsletter action()` function. An unauthenticated attacker could potentially unsubscribe newsletter subscribers by forging a request, provided they can trick a logged-in user into performing an action, such as clicking a malicious link. **Recommendations** Update The Newsletter – Send awesome emails from WordPress plugin to version 9.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** ForumWP – Forum & Discussion Board plugin for WordPress versions prior to 2.1.7 **Description** The ForumWP plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping when handling a User's Display Name. Authenticated attackers with Subscriber-level access or higher can inject malicious web scripts into pages. These scripts will then execute whenever a user views the affected page. **Recommendations** Update to version 2.1.7 or later.