CVE-2024-38273 moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access...

CVE-2024-38273 moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access...

CVE-2024-38273

CVE-2024-38273 involves Moodle integration with BigBlueButton. Insufficient capability checks can let users access join URLs they should not see, causing information disclosure of meeting access tokens. Evidence: OSV entry BIT-MOODLE-2024-38273 and Nessus notes of unpatched status; Fedora updates...

CVE-2024-38273 moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access...

PT-2024-27912 · Unknown +1 · Bigbluebutton +1

Name of the Vulnerable Software and Affected Versions: BigBlueButton affected versions not specified Description: Insufficient capability checks allowed users to gain access to BigBlueButton join URLs they did not have permission to access. Recommendations: At the moment, there is no information...

CVE-2023-6696

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check...

PT-2024-20944 · WordPress · Popup Builder

Name of the Vulnerable Software and Affected Versions: Popup Builder plugin for WordPress affected versions not specified Description: The issue allows authenticated attackers with subscriber-level access and above to perform unauthorized actions due to a missing capability check on all AJAX...

PT-2024-15054 · WordPress · The Popup Builder

Name of the Vulnerable Software and Affected Versions: The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress versions up to, and including, 4.3.1 Description: The issue arises from a missing capability check on several functions, allowing unauthorize...

CVE-2024-5468

The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stmhbdelete function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to...

CVE-2024-5468 WordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion

The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stmhbdelete function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to...

CVE-2024-5468

The CVE-2024-5468 entry corresponds to WordPress Header Builder Plugin – Pearl (≤ 1.3.7). It describes an unauthorized deletion of arbitrary site options due to missing validation and capability checks in stm_hb_delete(), exploitable by unauthenticated attackers and potentially enabling DoS. Publ...

WordPress Header Builder Plugin – Pearl < 1.3.8 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion

Description The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stmhbdelete function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated...

CVE-2024-4468

The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admininit in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber...

CVE-2024-5087

The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validateajax, deactivateajax, and saveajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated...

PT-2024-31208 · WordPress · Salon Booking System

Name of the Vulnerable Software and Affected Versions: The Salon booking system plugin for WordPress versions up to, and including, 9.9 Description: The issue allows unauthorized access and modification of data due to a missing capability check on several functions hooked into admin init. This...

CVE-2024-5607

The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers,...

PT-2024-34448 · WordPress · The Minimal Coming Soon – Coming Soon Page

Name of the Vulnerable Software and Affected Versions: The Minimal Coming Soon – Coming Soon Page plugin for WordPress versions up to, and including, 2.38 Description: The issue is related to unauthorized modification of data due to a missing capability check on the validate ajax, deactivate ajax...

CVE-2023-6966

The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/coreajax.php file in all versions up to, and including, 9.5.20. This makes it possible for...

CVE-2024-5459

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'addsection', 'addmenu', 'addmenuitem', and 'addmenupage' functions in all versions up to, and including, 2.4.16. This makes it possible for authenticated...

CVE-2024-5453

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdismissiblenotice and pmwizardupdategroupicon functions in all versions up to, and including, 5.8.6. This makes it possible fo...