WordPress WooCommerce Google Feed Manager plugin <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Feed Actions vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Feed Actions vulnerability discovered by Lucio Sá in WordPress Plugin WooCommerce Google Feed Manager versions = 2.8.0...

PT-2024-38812 · WordPress · Imagerecycle

Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin for WordPress versions up to, and including, 3.1.14 Description: The issue is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This allow...

PT-2024-7309 · Icms · Icms

Name of the Vulnerable Software and Affected Versions: iCMS affected versions not specified Description: The issue is related to a cross-site request forgery CSRF vulnerability in the iCMS content management system. It can be exploited by a remote attacker using a specially crafted HTTP request,...

CVE-2024-42768

A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/deleteroom.php...

UBUNTU-CVE-2024-3127

An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL...

CVE-2024-39744

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-39744

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-39744 IBM Sterling Connect:Direct Web Services cross-site request forgery

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-39744 IBM Sterling Connect:Direct Web Services cross-site request forgery

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2022-48932

CVE-2022-48932 affects the Linux kernel in the net/mlx5 driver: slab-out-of-bounds in mlx5_cmd_dr_create_fte when a rule with many destinations (up to 32) is added. The issue manifests as a KASAN slab-out-of-bounds. The patch fixes it by (1) enlarging allocated buffers to accommodate the required...

GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab Enterprise Edition versions 12.5 through 17.1.6, 17.2 through 17.2.4, and 17.3 through 17.3.1, which stems from the fact that under certain circumstances, it may...

Kashipara Hotel Management System 安全漏洞

Kashipara Hotel Management System is a hotel management system from Kashipara. A cross-site request forgery vulnerability exists in Kashipara Hotel Management System v1.0, which can be exploited by an attacker to forge a malicious request and trick a victim into clicking on it to perform a...

CVE-2024-20486 Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

Improper Access Control

ghost and @tryghost/portal is vulnerable for Improper Access Control. The vulnerability is due to missing authentication checks on certain endpoints used for member actions, allowing attackers to perform member-only actions and read member information without proper authorization...

Gitlab -- vulnerabilities

Gitlab reports: The GitLab Web Interface Does Not Guarantee Information Integrity When Downloading Source Code from Releases Denial of Service by importing maliciously crafted GitHub repository Prompt injection in "Resolve Vulnerabilty" results in arbitrary command execution in victim's pipeline ...

GHSA-78X2-CWP9-5J42 Ghost's improper authentication allows access to member information and actions

Impact Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. Vulnerable versions This security vulnerability is present in Ghost v4.46.0-v5.89.5. GhostPro customers are automatically updated to fixed...

Ghost's improper authentication allows access to member information and actions

Impact Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. Vulnerable versions This security vulnerability is present in Ghost v4.46.0-v5.89.5. GhostPro customers are automatically updated to fixed...

CVE-2024-43409 Ghost's improper authentication allows access to member information and actions

Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this iss...

CVE-2024-43409

CVE-2024-43409 concerns Ghost, a Node.js CMS, with an improper authentication flaw on several member-action endpoints. The issue allows an attacker to perform member-only actions and read member information when exploiting vulnerable versions. Affected range includes Ghost v4.46.0–v5.89.4, with a...