CVE-2024-10111

CVE-2024-10111 is an authentication bypass in the WordPress plugin OAuth Single Sign On – SSO (OAuth Client). Up to and including version 6.26.3, the token’s returned user is not properly verified, enabling unauthenticated attackers to log in as any existing site user (potentially an Administrato...

ROS-20241211-12

A vulnerability in the RADIUS authentication protocol implementation is related to bypassing the authentication procedure through capture-replay of intercepted messages. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access by forging an authentication...

CVE-2024-45494

An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected...

CVE-2024-12057

PcVue Web back end vulnerability CVE-2024-12057 causes user credentials to be written to log files when a user authenticates with an incompatible Web client, potentially allowing an attacker with access to logs to retrieve login data and gain unauthorized access to the application. Document set c...

CVE-2023-24375

The CVE-2023-24375 entry describes a Missing Authorization (Broken Access Control) vulnerability in the miniOrange WordPress Social Login and Register plugin for Discord, Google, Twitter, and LinkedIn. Affected versions are 7.5.14 and earlier. The underlying issue is incorrectly configured access...

CVE-2023-49856 WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability

Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through = 2.6.84...

CVE-2024-48956

CVE-2024-48956 affects Serviceware Processes versions 6.0 through 7.3 prior to 7.4. The issue enables unauthenticated attackers to send a specially crafted HTTP request to a service endpoint, leading to remote code execution. Public sources in the provided documents consistently describe this as ...

CVE-2024-11380

The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-47547

CVE-2024-47547 affects Ruijie Reyee OS 2.206.x–2.319.x (2.320.x not affected). The root cause is a weak password-change/reset mechanism that enables brute-force authentication attempts, potentially allowing attackers to compromise accounts. Public sources in connected documents corroborate a CSIR...

CVE-2024-47547 Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks...

CVE-2024-47547 Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks...

CVE-2024-48859 QTS, QuTS hero

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 bui...

CVE-2024-48859 QTS, QuTS hero

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 bui...

CVE-2024-10776 SICK InspectorP61x and SICK InspectorP62x: missing authentication

Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write files or load apps that use all features of the product available to a customer...

CVE-2024-11022 SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack

The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used several times for login and is therefore vulnerable for a replay attack...

CVE-2024-11022 SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack

The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used several times for login and is therefore vulnerable for a replay attack...

CVE-2024-11339

The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11323

CVE-2024-11323 affects the WordPress plugin AI Quiz | Quiz Maker (≤1.1). The root cause is a missing capability check in ai_quiz_update_style(), allowing authenticated users with Subscriber+ privileges to modify arbitrary options and potentially escalate to admin by changing default registration ...

QNAP Systems QTS和QuTS hero 安全漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems, Inc.QNAP Systems QTS is an entry operating system.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in QNAP Systems QTS and QuTS hero that stems from the inclusion ...

SonicWALL SMA100 安全漏洞

The SonicWALL SMA100 is a security access gateway device from SonicWALL USA. A security vulnerability exists in the SonicWALL SMA100. An authenticated, remote attacker could exploit the vulnerability to bypass certificate requirements during authentication...