PT-2024-37544 · WordPress · Mstore Api

Name of the Vulnerable Software and Affected Versions: MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress versions up to, and including, 4.14.7 Description: The issue is due to insufficient verification on the phone parameter of the firebase sms login and firebase sms...

CVE-2024-27710

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentication mechanism...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from Samsung South Korea. A security vulnerability exists in SAMSUNG Mobile devices SMR Jul-2024 Release 1 prior to version 1, which stems from an improper authentication issue in the MTP applicatio...

The vulnerability of Nighthawk WiFi 6 Router (RAX30)’s microprogramming software, related to authentication procedures that allow attackers to execute arbitrary codes,

The vulnerability of Nighthawk WiFi 6 Router RAX30’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

The vulnerability of cloud software in creating and using Nextcloud Server and Nextcloud Enterprise Server lies in the authentication procedures’ flaws, which allow attackers to bypass the authentication process.

The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass the 2FA authentication process...

CVE-2024-27867

An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in...

WordPress plugin Bricks Builder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-37480 · Wyze · Wyze Cam V3

Name of the Vulnerable Software and Affected Versions: Wyze Cam v3 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. The specific flaw exists within the "run action batch" endpoi...

The vulnerability of the Rockwell Automation FactoryTalk View SE human-machine interface control software, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of the Rockwell Automation FactoryTalk View SE human-machine interface management software is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions remotely...

WordPress plugin WP Tools security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

The vulnerability of the Microsoft Dynamics 365 Business Central software for small and medium-sized businesses stems from deficiencies in the authentication process, which allows attackers to escalate their privileges.

The vulnerability of the Microsoft Dynamics 365 Business Central software for small and medium-sized businesses is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to increase their privileges remotely...

The vulnerability of Netgear WNR614 N300 Wi-Fi router’s microprogramming software, related to authentication procedures that allow intruders to create arbitrary passwords.

The vulnerability of Netgear WNR614 N300 Wi-Fi router’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a remote attacker to create arbitrary passwords...

CVE-2024-37895 API Key Leak in lobe-chat

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issu...

CVE-2024-6057

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature...

CVE-2024-3971

The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

The vulnerability of the application programming interface for managing policies and security standards of IT infrastructure management tool Tripwire Enterprise (TE) allows a perpetrator to circumvent security restrictions, enhance their privileges, and gain access to read and modify data.

The vulnerability of the application programming interface for managing policies and security standards of IT infrastructure tools like Tripwire Enterprise TE is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass security...

WordPress plugin Leyka security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of the microprogrammed software of HP Color LaserJet MFP series M478-M479 printers lies in the authentication procedures’ deficiencies, which allow attackers to disclose confidential information about SMTP server credentials.

The vulnerability of the microprogrammed software of HP Color LaserJet MFP series printers like M478-M479 is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to disclose sensitive information about SMTP server credentials...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to deficiencies in the authentication mechanism, allows a hacker to impersonate a cloud agent.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to impersonate a cloud agent...

Vulnerability of the Client component: mysqldump in the Oracle MySQL Server database management system. This component allows attackers to gain unauthorized access for reading, adding, modifying, or deleting protected information, or to cause a service failure.

The vulnerability of the Client component, mysqldump in the Oracle MySQL Server database management system, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read, add, modify, or delete protected...