CVE-2024-27474

Leantime version 3.0.6 is vulnerable to a Cross-Site Request Forgery (CSRF) weakness. This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators . When triggered, the CSRF vulnerability can be used to create and elevate...

CVE-2024-27474

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery CSRF. This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators...

CVE-2024-1850 AI Post Generator | AutoWriter <= 3.3 - Missing Authorization

The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with...

CVE-2024-1850 AI Post Generator | AutoWriter <= 3.3 - Missing Authorization

The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with...

CVE-2024-1637

The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access o...

Microsoft Releases April 2024 Security Updates 

Microsoft released security updates to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following and apply the necessary updates: Microsoft...

CVE-2024-1637: Missing Authorization

The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access o...

PT-2024-23262 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4 HANA affected versions not specified Description: The issue is related to the Cash Management component in SAP S/4 HANA, which fails to perform necessary authorization checks for an authenticated user. This results in an escalation of...

MTN Group: Unauthorized access to PII leads to Administrator account Takeover

The vulnerability arises from insufficient restrictions placed on the list of post authors, which could be exploited by remote attackers to obtain sensitive information through wp/v2/users/15 requests. The sensitive information, including email addresses, could be obtained and used in further...

CVE-2024-31851

A path traversal vulnerability exists in the Java version of CData Sync 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

CVE-2024-31851

CVE-2024-31851 – Path traversal in CData Sync (Java, embedded Jetty) Affected software: CData Sync Java edition prior to 23.4.8843 running with the embedded Jetty server. Vulnerability: Path traversal vulnerability allowing an unauthenticated remote attacker to access sensitive information and pe...

CVE-2024-31851

A path traversal vulnerability exists in the Java version of CData Sync 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

CVE-2024-31850

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

Mattermost fails to authenticate the source of certain types of post actions

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action...

CVE-2024-2447

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action...

CVE-2024-2447

Summary: CVE-2024-2447 affects Mattermost Server releases: 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2. The root cause is failure to authenticate the source of certain post actions, allowing an authenticated attacker to create posts as other users via a cra...

CVE-2024-2447

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action...

CVE-2024-2447: Improper Access Control

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action...

PT-2024-20411 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.10 Mattermost versions 9.3.x through 9.3.2 Mattermost versions 9.4.x through 9.4.3 Mattermost versions 9.5.x through 9.5.1 Description: The issue is related to the failure of Mattermost to authenticate th...

CVE-2024-31204

mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEVMODE. The system saves...