ALSA-2024:10244 Important: pam:1.5.1 security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: pam: Improper Hostname Interpretation in pamaccess Leads to Access Control Bypass CVE-2024-10963 For more details about the...

Important: pam:1.5.1 security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: pam: Improper Hostname Interpretation in pamaccess Leads to Access Control Bypass CVE-2024-10963 For more details about the...

PT-2025-29117

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.35 through 2.4.63 Description: In certain mod ssl configurations, an access control bypass is possible for trusted clients using TLS 1.3 session resumption. This occurs when mod ssl is configured for multiple...

PT-2024-31249 · Unknown · Meabilis Cms

Name of the Vulnerable Software and Affected Versions: Meabilis CMS version 1.0 Description: The issue allows attackers to bypass access controls and access other users' address books through unspecified vectors. Recommendations: For Meabilis CMS version 1.0, at the moment, there is no informatio...

PT-2024-16606 · WordPress · La-Studio Element Kit For Elementor

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.2 Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server v...

Access Control Bypass

Overview influxdb-client is an InfluxDB 2.0 Python client library Affected versions of this package are vulnerable to Access Control Bypass due to a business logic flaw that allows users who own a valid allAccess token to escalate their privileges at operator level by listing current authorizatio...

Access Control Bypass

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass due to insufficient access control checks in the process of fetching course badges. Remediation Upgrade moodle/moodle to version 4.4.4 or higher. References - GitHub Commit -...

Access Control Bypass

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass due to insufficient permission checks during the account deletion process. Remediation Upgrade moodle/moodle to version 4.1.13, 4.2.10, 4.3.7, 4.4.3 or higher. References -...

CVE-2024-45611 GLPI has a stored XSS at src/RSSFeed.php

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload t...

Access Control Bypass

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Access Control Bypass through the normalizePath function, by utilizing a double file:// scheme to bypass local file system validation. Note: This is only exploitable if the administrator has ...

The vulnerability of the qcom component in the Linux operating system’s kernel allows a hacker to manipulate the accessibility of protected information.

The vulnerability of the qcom component in the Linux operating system’s kernel is related to errors in reading beyond the boundary of the function F. Exploiting this vulnerability can allow an attacker to influence the accessibility of protected information...

freeradius: forgery attack

A vulnerability in the RADIUS Remote Authentication Dial-In User Service protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof...

Access Control Bypass

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass due to insufficient access control mechanisms implemented in the external API for quiz overrides. Remediation Upgrade moodle/moodle to version 4.4.2 or higher. References -...

Access Control Bypass

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass due to improper verification of message recipients in the non-respondents report feature. An attacker can send messages to arbitrary site users by exploiting this verification...

Access Control Bypass

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass due to insufficient capability checks. An attacker can delete badges they are not authorized to access by exploiting these checks. Remediation Upgrade moodle/moodle to version...

Access Control Bypass

sigs.k8s.io/aws-load-balancer-controller is vulnerable to Access control bypass. The vulnerability is due to the controller’s automatic disassociation of WebACLs from ALBs when specific annotations are missing, which unintentionally removes WebACL protections, even if they were configured by AWS...

freeradius: forgery attack

A vulnerability in the RADIUS Remote Authentication Dial-In User Service protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof...

CVE-2024-43302

Missing Authorization vulnerability in Fonts Plugin Fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fonts: from n/a through 3.7.7...

CVE-2024-43253

Missing Authorization vulnerability in Zaytech Smart Online Order for Clover allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Smart Online Order for Clover: from n/a through 1.5.6...

CVE-2024-37094

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12...