GHSA-CCQV-43VM-4F3W Gogs allows deletion of internal files

Impact Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUNUSER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. Patches Deletion of .git files has been prohibit...

CVE-2024-12902

ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default...

CVE-2024-12902

The CVE covers Global Wisdom Software ANCHOR running on a Windows VM, where default passwords on high-privilege Windows service accounts could let an attacker remotely log in to the VM. Public documents confirm the vulnerability vector as remote access via default credentials, driven by OS-level ...

Global Wisdom ANCHOR 安全漏洞

Global Wisdom ANCHOR is an integrated product from Global Wisdom, Inc. that runs on Windows virtual machines. A security vulnerability exists in Global Wisdom ANCHOR that originates from the underlying Windows operating system that contains highly privileged service accounts. These accounts use...

Meta Fined €251 Million for 2018 Data Breach Impacting 29 Million Accounts

Meta Platforms, the parent company of Facebook, Instagram, WhatsApp, and Threads, has been fined €251 million around $263 million for a 2018 data breach that impacted millions of users in the bloc, in what's the latest financial hit the company has taken for flouting stringent privacy laws. The...

CVE-2024-55057

Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts...

CVE-2024-55057

Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts...

CVE-2024-55057

Technical details about CVE-2024-55057 are not publicly provided in the connected documents. The materials summarize inadequate password requirements but do not specify affected versions, components, or remediation steps. Monitor for updates.

CVE-2024-55057

Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts...

The vulnerability of the WhatsUp Gold network infrastructure monitoring system lies in the lack of protective measures for the SQL query structure, allowing attackers to gain unauthorized access to user accounts.

The vulnerability of the WhatsUp Gold network infrastructure monitoring system lies in the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to user accounts...

CVE-2024-11721

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated...

CVE-2024-11721

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated...

CVE-2024-11721

CVE-2024-11721 concerns Frontend Admin by DynamiApps (WordPress)

AuthQuake Flaw Allowed MFA Bypass Across Azure, Office 365 Accounts

SUMMARY Cybersecurity researchers at Oasis Security have identified a vulnerability in Microsoft's Multi-Factor Authentication MFA, known as AuthQuake,…...

DRUPAL-CONTRIB-2024-073

This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass...

SAMR Account Management

Add, lookup and delete user / machine accounts via MS-SAMR. By default standard active directory users can add up to 10 new computers to the domain MachineAccountQuota. Administrative privileges however are required to delete the created accounts, or to create/delete user accounts. Module Options...

Improper Authorization

moodle/moodle is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation of permissions, allowing users to bypass restrictions and delete OAuth2-linked accounts...

CVE-2024-54147 Altair GraphQL Client's desktop app does not validate HTTPS certificates

Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks eg. public wifi, malicious DNS servers may have all GraphQL...

Learn How Experts Secure Privileged Accounts—Proven PAS Strategies Webinar

Cybercriminals know that privileged accounts are the keys to your kingdom. One compromised account can lead to stolen data, disrupted operations, and massive business losses. Even top organizations struggle to secure privileged accounts. Why? Traditional Privileged Access Management PAM solutions...

CVE-2024-42494

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services...