CVE-2024-3029

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multiusermode'. The...

PT-2024-17001

Name of the Vulnerable Software and Affected Versions Devklan's Alma Blog versions 2.1.10 and earlier Description The issue allows a remote user to retrieve all valid users registered in the application by analyzing the request response. This could lead to information disclosure. Recommendations...

CVE-2024-1104

An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...

UBUNTU-CVE-2024-1439

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent...

PT-2023-8225

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 2.3 through 14.10.14 XWiki Platform versions 15.5.1 and earlier XWiki Platform versions prior to 15.7-rc-1 Description The issue is related to incorrect code generation management in the XWiki Platform, allowing a remot...

Fail to enumerate resource with "Cannot complete your request "error after configure SAML

Fail to enumerate resource with "Cannot complete your request "error after configure SAML All users have the same issue Issue happen after click "detect Workspace" on Storefront web...

CVE-2023-4023

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

CVE-2023-4023

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

Design/Logic Flaw

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

CVE-2023-4023 All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

CVE-2023-4023

CVE-2023-4023 – All Users Messenger (WordPress) vulnerability : The All Users Messenger plugin (≤1.24) allows non-administrator users with Subscriber privileges to delete messages due to missing access control (IDOR). Descriptions across connected sources confirm the issue as a broken-access-cont...

WordPress plugin All Users Messenger 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-4023: Undefined Security Weakness

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

PT-2023-27340 · WordPress · All Users Messenger

Name of the Vulnerable Software and Affected Versions: All Users Messenger WordPress plugin versions 1.24 and earlier Description: The issue concerns the All Users Messenger WordPress plugin, where non-administrator users can delete messages from the all-users messenger due to a lack of proper...

CVE-2023-3253

An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application...

Tenable Network Security Nessus 安全漏洞

Tenable Network Security Nessus is an open source system vulnerability scanner from US-based Tenable Network Security. A security vulnerability exists in versions of Tenable Network Security Nessus prior to 10.6.0, which stems from an incorrect authorization vulnerability that allows an...

PT-2023-23860 · Tenable · Nessus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An improper authorization issue exists, allowing an authenticated, low-privileged remote attacker to view a list of all users available in the...

WordPress All Users Messenger Plugin <= 1.24 is vulnerable to Broken Access Control

Software All Users Messenger Type Plugin Vulnerable versions = 1.24 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4023 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID db4d05aa5b71 Credits Dmitrii Ignatyev Required...

CVE-2023-31462

An issue was discovered in SteelSeries GG 36.0.0. An attacker can change values in an unencrypted database that is writable for all users on the computer, in order to trigger code execution with higher privileges...

CVE-2022-45180

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskDOMAIN/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system a...