WordPress plugin Blogger Buzz 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Drugs.com: 2FA Bypass leads to impersonation of legimate users

The authentication system contained a logic flaw that allowed an attacker to impersonate a legitimate user who had not yet registered. By abusing the email change functionality and bypassing two-factor authentication, the attacker could retain access to the account until the legitimate user reset...

The vulnerability of the Universal Monitoring System Interface of Zabbix, which allows attackers to escalate their privileges

The vulnerability of the Zabbix monitoring system’s universal interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...

WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Missing Authorization to Authenticated (Subscriber+) Deactivation Submission vulnerability

Missing Authorization to Authenticated Subscriber+ Deactivation Submission vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Eleblog – Elementor Blog And Magazine Addons versions = 1.8...

Apache Ozone 安全漏洞

Apache Ozone is an application of the US Apache Apache Foundation. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. Apache Ozone version 1.4.0 suffers from an authentication error vulnerability that originates from an authentication error in an HTTP...

The vulnerability of the ProjectSend file-sharing software is related to deficiencies in the authentication process, which allows attackers to modify the application’s configuration.

The vulnerability of the ProjectSend file-sharing software is related to deficiencies in its authentication procedures. Exploiting this vulnerability allows a malicious actor to remotely modify the application’s configuration by sending specially crafted HTTP requests...

The vulnerability of Zyxel P-6101C router microprogramming software, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.

The vulnerability of Zyxel P-6101C router microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a specially crafted HTTP request...

DEBIAN-CVE-2024-36466

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

PT-2024-8877 · Microsoft · Azure Policywatch

Name of the Vulnerable Software and Affected Versions: Microsoft Azure PolicyWatch affected versions not specified Description: The issue is related to a lack of authentication for a critical function in Microsoft Azure PolicyWatch, allowing an unauthorized attacker to elevate privileges over a...

ProjectSend 安全漏洞

ProjectSend cFTP is the ProjectSend open source suite of self-hosted applications based on PHP and MySQL. A security vulnerability exists in ProjectSend versions prior to r1720, which stems from being affected by an authentication vulnerability that allows a remote, unauthenticated attacker to se...

The vulnerability of the virtual learning environment Moodle, related to deficiencies in the authentication process, allows a perpetrator to bypass the authentication process.

The vulnerability in the virtual learning environment Moodle is related to deficiencies in the authentication process when processing “magic hash” passwords. Exploiting this vulnerability can allow a malicious actor to bypass the authentication process...

The vulnerability of TOTOLINK A3300R router’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to bypass security restrictions and change Wi-Fi passwords.

The vulnerability of TOTOLINK A3300R router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and change the Wi-Fi password by resetting it on the /wizard.html or...

Cohesive Networks VNS3 操作系统命令注入漏洞

Cohesive Networks VNS3 is a VPN Virtual Private Network solution from Cohesive Networks, Inc. Cohesive Networks VNS3 suffers from an operating system command injection vulnerability that stems from a lack of proper authentication before executing a system call using a user-supplied string. An...

The vulnerability of the Cobbler network installation server, related to deficiencies in authentication procedures, allows attackers to gain full access to the server.

The vulnerability of the Cobbler network installation server is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain full access to the server...

UBUNTU-CVE-2024-47533

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

CVE-2024-52942

Veritas Enterprise Vault is affected prior to 15.1 UPD882911. The HTMLView endpoint allows an authenticated attacker to inject data into HTTP requests, enabling reflected XSS when viewing archived content. Root cause: insufficient validation of user-supplied data in HTMLView. Impact: XSS could be...

The vulnerability of the Azure CycleCloud tool for organizing and managing high-performance computing environments, related to deficiencies in the authentication process, allows a perpetrator to execute arbitrary code.

The vulnerability of the Azure CycleCloud tool for organizing and managing high-performance computing environments is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

python-django: Username enumeration through timing difference for users with unusable passwords

A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...

The vulnerability of the Task Scheduler in Windows operating systems allows a malicious individual to escalate their privileges.

The vulnerability of the Task Scheduler in Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to increase their privileges, provided that a specially crafted application is executed. Additionally, updates from...

Fortinet Fortigate - SSLVPN session hijacking using SAML authentication (FG-IR-23-475)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-475 advisory. - A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows...