CVE-2024-2217 Improper Access Control in gaizhenbiao/chuanhuchatgpt

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys...

CVE-2024-2217

CVE-2024-2217 concerns improper access control in gaizhenbiao/chuanhuchatgpt, allowing unauthorized access to the config.json file in both authenticated and unauthenticated versions. The flaw enables retrieval of sensitive data such as OpenAI/Google/XMChat API keys, configuration details, and use...

CVE-2024-2217: Improper Access Control

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys...

Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1

Summary Audit records for OpenAPI requests may include sensitive information. Impact Unauthorized access, privilege escalation. Mitigation Nozomi Networks recommends creating specific users for OpenAPI usage, with only the necessary permissions to access the required data sources. Additionally, i...

PT-2024-19255 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt affected versions not specified Description: The issue is related to improper access control, allowing unauthorized access to the config.json file. This affects both authenticated and unauthenticated versions of the...

Siemens RUGGEDCOM APE1808

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2024-2476

The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadthemepanelpane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose...

CVE-2024-2476 OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion

The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadthemepanelpane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose...

CVE-2024-2476

CVE-2024-2476 concerns OceanWP for WordPress. The vulnerability is due to a missing capability check in load_theme_panel_pane, affecting all versions up to 3.5.4. The impact, as described in the sources, is unauthorized access to data for authenticated users with subscriber-level access and above...

Behind the Scenes: The Art of Safeguarding Non-Human Identities

In the whirlwind of modern software development, teams race against time, constantly pushing the boundaries of innovation and efficiency. This relentless pace is fueled by an evolving tech landscape, where SaaS domination, the proliferation of microservices, and the ubiquity of CI/CD pipelines ar...

Insertion Of Sensitive Information Into Log File

Kibana is vulnerable to Insertion of Sensitive Information into Log File. The vulnerability is caused due to improper handling of errors or debug logging, leading to the inclusion of credentials, API keys, and other sensitive data in Kibana logs. This potentially leads to Sensitive Information...

CVE-2024-0368

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII...

CVE-2024-0368

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII...

Hardcoded credentials

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII...

CVE-2024-0368

The Hustle plugin for WordPress (wordpress-popup) versions up to and including 7.8.3 contains hardcoded HubSpot credentials in inc/providers/hubspot/hustle-hubspot-api.php (CLIENT_ID, CLIENT_SECRET, HAPIKEY). This root cause enables exposure of HubSpot API keys and potential access to PII via Hub...

CVE-2024-0368: Insufficiently Protected Credentials

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII...

PT-2024-15503 · WordPress · The Hustle – Email Marketing

Name of the Vulnerable Software and Affected Versions: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress versions up to, and including, 7.8.3 Description: The issue allows unauthenticated attackers to extract sensitive data, including personally identifiable...

Secrets Sensei: Conquering Secrets Management Challenges

In the realm of cybersecurity, the stakes are sky-high, and at its core lies secrets management — the foundational pillar upon which your security infrastructure rests. We're all familiar with the routine: safeguarding those API keys, connection strings, and certificates is non-negotiable. Howeve...

Human vs. Non-Human Identity in SaaS

In today's rapidly evolving SaaS environment, the focus is on human users. This is one of the most compromised areas in SaaS security management and requires strict governance of user roles and permissions, monitoring of privileged users, their level of activity dormant, active, hyperactive, thei...

BIT-ELASTICSEARCH-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...