PT-2024-26547 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/ca deal.php component. The API Endpoint "/admin/ca deal.php" is vulnerable, specifically with parameters mudi=del and empty dataType and...

CentOS 8 : xorg-x11-server-Xwayland (CESA-2024:2996)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:2996 advisory. - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data...

CVE-2021-47293 net/sched: act_skbmod: Skip non-Ethernet packets

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: Skip non-Ethernet packets Currently tcfskbmodact assumes that packets use Ethernet as their L2 protocol, which is not always the case. As an example, for CAN devices: $ ip link add dev vcan0 type vcan $ ip...

CVE-2023-3942 Multiple SQLi in ZkTeco-based OEM devices

An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the...

Cross-Site Scripting

Cacti is vulnerable to Cross-site Scripting. The vulnerability is due to malicious scripts being permanently stored on a target server and served to users who access a particular page, which attackers can use to execute scripts in the context of the user's browser, potentially leading to...

Mozilla: csrftoken not unique to session or specific user and csrfmiddlewaretoken can be altered

The CSRF token used in the application was not unique to the session or specific user, allowing an attacker to use a valid CSRF token obtained from another user to perform unauthorized actions on behalf of that user...

CVE-2023-3942: Improper Neutralization of Special Elements used in an SQL Command

An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the...

CVE-2024-27312

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...

CVE-2024-27312

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...

CVE-2024-27312 Authorization vulnerability in PAM360

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...

CVE-2024-27312

The CVE-2024-27312 entry concerns Zohocorp ManageEngine PAM360 version 6601, where an authorization vulnerability allows a low-privileged user to perform admin actions. The issue is limited to 6601; other PAM360 versions are not indicated as affected in the provided documents. The root cause is d...

Fastly < 1.2.26 - Missing Authorization via AJAX actions

Description The Fastly plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the plugin's AJAX actions in versions up to, and including, 1.2.25. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

PT-2024-21814 · Zohocorp · Manageengine Pam360

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine PAM360 version 6601 Description: The issue allows a low-privileged user to perform admin actions due to an authorization vulnerability. Recommendations: For Zohocorp ManageEngine PAM360 version 6601, update to a version...

CVE-2024-27312: Incorrect Authorization

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...

Fast Custom Social Share by CodeBard <= 1.1.2 - Cross-Site Request Forgery

Description The Fast Custom Social Share by CodeBard plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions...

Clearfy Cache <= 2.2.1 - Cross-Site Request Forgery

Description The Clearfy Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request...

GitLab 9.5 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13263)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perfo...

PT-2024-26203

Name of the Vulnerable Software and Affected Versions Fast Custom Social Share by CodeBard versions 1.1.2 and earlier Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge. No information...

PT-2024-26163

Name of the Vulnerable Software and Affected Versions Integration for Contact Form 7 HubSpot versions 1.3.1 and earlier Description A Cross-Site Request Forgery CSRF issue affects the CRM Perks Integration for Contact Form 7 HubSpot. This issue allows an attacker to perform unintended actions on ...

PT-2024-13197

Name of the Vulnerable Software and Affected Versions WP Hive Events Rich Snippets for Google versions 1.8 and earlier Description A Cross-Site Request Forgery CSRF issue allows exploitation of trusted credentials. This can lead to unauthorized actions being taken on behalf of the user...