CVE

Id
71145  
CVE No.
CVE-2014-3849  
Status
Candidate  
Description
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.  
Phase
Assigned (20140523)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
676888 71145 CVE-2014-3849 EXPLOIT-DB:33076  View
676889 71145 CVE-2014-3849 URL:http://www.exploit-db.com/exploits/33076  View
676890 71145 CVE-2014-3849 FULLDISC:20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)  View
676891 71145 CVE-2014-3849 URL:http://seclists.org/fulldisclosure/2014/Apr/265  View
676892 71145 CVE-2014-3849 MISC:http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html  View
676893 71145 CVE-2014-3849 OSVDB:106300  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
14324 JVNDB-2014-003199 Kerio Control の Kerio Control Statistics における SQL インジェクションの脆弱性 Kerio Control (旧 WinRoute Firewall) の Kerio Control Statistics には、SQL インジェクションの脆弱性が存在します。 CVE-2014-3857 71145 6.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003199.html  View