The vulnerability of the PAM authentication mechanism for Authd in Ubuntu operating systems allows a hacker to gain access to another user’s account.

The vulnerability of the PAM authentication mechanism for Authd in Ubuntu operating systems is related to errors in privilege management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to another user’s account by executing commands like “su”, “sudo”...

CVE-2024-47616 Pomerium's service account access token may grant unintended access to databroker API

Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token JWT signed by a key known by all Pomerium servic...

Computer Vision Annotation Tool 安全漏洞

Computer Vision Annotation Tool CVAT is a cvat.ai open source interactive video and image annotation tool for computer vision. A security vulnerability exists in Computer Vision Annotation Tool versions 2.0.0 through 2.19.0 that originates from an attacker with an account that can retrieve certai...

CVE-2024-8290

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFMCustomersManageController::processing function due to missing validation...

CVE-2024-8349

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group...

CVE-2024-8349 Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group...

CVE-2024-8349

CVE-2024-8349 / CVE-2024-8350 (Uncanny Groups for LearnDash, WordPress) : The WordPress plugin is vulnerable to privilege escalation via a flawed access check in the group-management REST endpoint. Authenticated users with group leader level access (and above) can add or modify group members and,...

CVE-2024-8349 Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group...

CVE-2024-45770

A vulnerability was found in Performance Co-Pilot PCP. This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges...

CVE-2024-45586

CVE-2024-45586 affects Symphony XTS Web Trading and Mobile Trading platforms, version 2.0.0.1_P160. The root cause is improper access controls in the Authentication module’s APIs. An authenticated, remote attacker can manipulate HTTP request parameters to perform an unauthorized account takeover ...

The vulnerability of the Junos OS Evolved operating system, related to deficiencies in access control, allows a perpetrator to resume an earlier session and gain access to the user account.

The vulnerability of the Junos OS Evolved operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to resume a previous session and gain access to the user account...

The vulnerability of the phpCAS::setUrl() function in the phpCAS authentication library allows a attacker to gain access to the user’s account.

The vulnerability of the phpCAS::setUrl function in the phpCAS authentication library relates to the use of HTTP headers to determine the URL address of the service used for ticket verification. This allows control over the host header and enables the use of a valid ticket for authentication in a...

PT-2024-5830 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2024-07 Description: A vulnerability has been discovered in the two-factor authentication 2FA mechanism of mailcow: dockerized, an open source groupware/email suite based on docker. This flaw allows an...

USN-6914-1: OCS Inventory vulnerability

Filip Hejsek discovered that the phpCAS library included in OCS Inventory was using HTTP headers to determine the service URL used to validate tickets. A remote attacker could possibly use this issue to gain access to a victim's account...

USN-6913-1 php-cas vulnerability

Filip Hejsek discovered that phpCAS was using HTTP headers to determine the service URL used to validate tickets. A remote attacker could possibly use this issue to gain access to a victim's account on a vulnerable CASified service. This security update introduces an incompatible API change. Afte...

VulnCheck KEV: CVE-2024-6695

it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process...

The vulnerability of the Single Sign-On module for application-based SAML protocols in the Apache CloudStack software, which is used for creating, managing, and deploying infrastructure cloud services, allows a perpetrator to bypass authentication processes and gain full access to any user’s account.

The vulnerability of the Single Sign-On module for application-based SAML programs involved in creating, managing, and deploying infrastructure cloud services like Apache CloudStack relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability allows a...

Error: "The domain/user does not have access to the farm" when Accessing the Management Console

Administrator account is not able to access the management console and it generates error, "the domain/user does not have access to the farm"...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution offers multiple payment methods, SMS alerts and product image zoom. A security vulnerability exists in PrestaShop Login as customer PRO prior to version 1.2.7, which stems from a direct link that...

43% of couples experience pressure to share logins and locations, Malwarebytes finds

All isn’t fair in love and romance today, as 43% of people in a committed relationship said they have felt pressured by their own partners to share logins, passcodes, and/or locations. A worrying 7% admitted that this type of pressure has included the threat of breaking up or the threat of physic...