Paul Dannewitz

Paul Dannewitz is a security researcher credited with 8 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #512 of 3,515 contributors. Their disclosures were published between 2017 and 2019. The most productive year was 2019, with 5 findings.

Their research concentrates on Cross-Site Request Forgery (CSRF), which accounts for 4 of their findings (50%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data. The average CVSS score across these disclosures is 8.2, peaking at 9.8. Severity breakdown: 1 critical and 6 high.

The most affected software includes Visitor Traffic Real Time Statistics (2), AddToAny Share Buttons (1), SmokeSignal (1), across 7 distinct plugins, themes and core versions in total.

7 of the 8 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Yet Another Stars Rating <= 1.8.6 - Unauthenticated PHP Object Injection", scores 9.8 out of 10.

201720182019

Critical

High

Medium

Low

Global Rank

#512

of 3,515 researchers

Vulns

Critical1

High6

Medium1

Low0

Affected Assets

7plugins

Avg CVSS

8.2

Average score of vulnerabilities

Researcher Submissions

8 records


2019-11-05 00:00	Tidio Live Chat < 4.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting Tidio < 4.2.1	`N/A`	8.8 High	Paul Dannewitz	Yes
2019-07-03 00:00	Visitor Traffic Real Time Statistics <= 1.12 - Cross-Site Request Forgery Visitor Traffic Real Time Statistics <= 1.12	`CVE-2019-15831`	8.8 High	Paul Dannewitz	Yes
2019-07-03 00:00	Visitor Traffic Real Time Statistics <= 1.13 - Cross-Site Request Forgery Visitor Traffic Real Time Statistics <= 1.13	`CVE-2019-15832`	8.8 High	Paul Dannewitz	Yes
2019-07-01 00:00	Widget Logic < 5.10.2 - Cross-Site Request Forgery Widget Logic < 5.10.2	`CVE-2019-12826`	8.8 High	Paul Dannewitz	Yes
2019-01-27 00:00	Yet Another Stars Rating <= 1.8.6 - Unauthenticated PHP Object Injection YASR <= 1.8.6	`N/A`	9.8 Critical	Paul Dannewitz	Yes
2017-09-02 00:00	SQL Shortcode <= 1.1 - SQL Execution SQL Shortcode <= 1.1	`N/A`	8.8 High	Paul Dannewitz	No
2017-09-02 00:00	Smoke Signal < 1.2.7 - Authenticated Stored Cross-Site Scripting SmokeSignal < 1.2.7	`N/A`	7.4 High	Paul Dannewitz	Yes
2017-08-16 00:00	AddToAny Share Buttons <= 1.7.14 - HTTP Host Header Injection AddToAny Share Buttons <= 1.7.14	`N/A`	4.7 Medium	Paul Dannewitz	Yes

Showing 1–8 of 8 reports