Vulnerabilities

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based XSS.This issue affects El mejor Cluster: from n/a through <= 1.1.15.

The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Cross-Site Request Forgery (CSRF) vulnerability in Leo Caseiro Custom Options Plus plugin <= 1.8.1 versions.

The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attack

An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to bypass authentication mechanisms via unspecified vectors.

CVE-2020-15505 is a critical, unauthenticated remote code execution vulnerability in Ivanti MobileIron's Core and Enterprise Connector, Sentry, and Monitor and Reporting Database (RDB) products, which public proof-of-concept exploits identify as a Hessian-based Java deserialization flaw. An unauthenticated attacker can send crafted requests to an affected MobileIron server over the network, with no privileges or user interaction required, and execute arbitrary code, gaining full control of the MDM server with high impact on confidentiality, integrity, and availability. Any organization running the affected versions of these enterprise mobile device management products is at risk, particularly internet-facing MobileIron Core and Sentry instances. Exploitation is confirmed and widespread: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added November 3, 2021), carries a 99.7% EPSS score, and was named among the top flaws exploited by Chinese state-sponsored hackers, prompting urgent UK NCSC patching alerts. It is also being observed chained with other exploited vulnerabilities (e.g., VPN flaws and Zerologon) as an initial-access vector, so defenders should treat it as actively exploited.

Do: Apply the vendor updates immediately per Ivanti's security advisory for MobileIron Core, Enterprise Connector, Sentry, and RDB (this is CISA's required action for KEV entries). Until patched, reduce internet exposure of MobileIron interfaces and monitor for exploitation; because the flaw was mass-exploited (including by Chinese state-sponsored actors), hunt for signs of compromise such as unexpected processes, persistence mechanisms, or webshells on affected MDM servers.

NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMailslot mailslot.

The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.