13610 matches found
CVE-2024-4997
The WPUpper Share Buttons plugin for WordPress is vulnerable to unauthorized access of data when preparing sharing links for posts and pages in all versions up to, and including, 3.43. This makes it possible for unauthenticated attackers to obtain the contents of password protected posts and page...
CVE-2024-1717
The Admin Notices Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handleajaxcall function in all versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
CVE-2024-4997 WPUpper Share Buttons <= 3.43 - Missing Authorization
The WPUpper Share Buttons plugin for WordPress is vulnerable to unauthorized access of data when preparing sharing links for posts and pages in all versions up to, and including, 3.43. This makes it possible for unauthenticated attackers to obtain the contents of password protected posts and page...
CVE-2024-3230
The WordPress Download Attachments plugin is vulnerable to Stored XSS in all versions up to 1.3 via the download-attachments shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access (contributor level or higher) a...
PT-2024-31478
Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version 20240410 Description An improper access control issue exists, allowing any user on the server to access the chat history of other users without interaction. This could lead to data breaches, exposing sensitiv...
CVE-2024-4520: Missing Authorization
An improper access control vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically in version 20240410. This vulnerability allows any user on the server to access the chat history of any other user without requiring any form of interaction between the users. Exploitation ...
keycloak: Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise...
keycloak: Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise...
MAL-2024-1452 Malicious code in @juiggitea/molestias-quo-nihil-modi (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9460ce6b7a5e9c2646ba5c2a4dff77162e5267b476b027f8fcd99d70eb18c156 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1415 Malicious code in @juiggitea/consequuntur-iure-maxime (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acd1d992b7310fef07ffe41951da097b2c107cab4ef49b0f1efa57cdc5a1a77f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Live Nation Confirms Massive Ticketmaster Data Breach
In an SEC filing, Live Nation Entertainment confirmed its subsidiary Ticketmaster suffered a data breach, claiming it will…...
A week in security (May 27 – June 2)
Last week on Malwarebytes Labs: Data leak site BreachForums is back, boasting Live Nation/Ticketmaster user data. But is it a trap? The Ticketmaster "breach"—what you need to know Ticketmaster confirms customer data breach How to tell if a VPN app added your Windows device to a botnet Beware of...
GHSA-QVPJ-W7XJ-R6W9 Password confirmation stored in plain text via registration form in statamic/cms
Users registering via the user:registerform tag will have their password confirmation stored in plain text in their user file. Impact This only affects sites matching all of the following conditions: - Running Statamic versions between 5.3.0 and 5.6.1. This version range represents only one...
PT-2024-33740
Name of the Vulnerable Software and Affected Versions yiisoft/yii2 version 2.0.48 Description The base Component class in yiisoft/yii2 contains a vulnerability where the set magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attack...
Ticketmaster confirms customer data breach
Live Nation Entertainment has confirmed what everyone has been speculating on for the last week: Ticketmaster has suffered a data breach. In a filing with the SEC, Live Nation said on May 20th it identified "unauthorized activity within a third-party cloud database environment containing Company...
The Ticketmaster Data Breach May Be Just the Beginning
Data breaches at Ticketmaster and financial services company Santander have been linked to attacks against cloud provider Snowflake. Researchers fear more breaches will soon be uncovered...
AI Company Hugging Face Detects Unauthorized Access to Its Spaces Platform
Artificial Intelligence AI company Hugging Face on Friday disclosed that it detected unauthorized access to its Spaces platform earlier this week. "We have suspicions that a subset of Spaces' secrets could have been accessed without authorization," it said in an advisory. Spaces offers a way for...
CVE-2024-1324
The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the saveremoteimagesgetautosavedresults function hooked via a norpriv AJAX in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated...
Moodle Security Breach
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from a stored cross-site scripting XSS vulnerability when editing another user's...
Astrotalks Security Breach
Astrotalks is a free online astrology prediction website from Astrotalks India. A security vulnerability exists in Astrotalks version 10/03/2023, which stems from improper privilege management...