1795 matches found
CVE-2024-6869 Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure
The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-6477
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address...
The vulnerability of the Email Address Handler component of the software platform based on Git for collaborative code development on GitLab allows a malicious individual to gain unauthorized access to limited functions.
The vulnerability of the Email Address Handler component in the Git-based software platform, which is used for collaborative code development on GitLab, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...
Time-of-check Time-of-use (TOCTOU) Race Condition
Apache streampipes is vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. The vulnerability arises from insufficient synchronization during user registration, allowing multiple simultaneous requests to check and register a user using the same email address. Attackers exploit this by...
CVE-2024-30471
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and...
CVE-2024-30471 Apache StreamPipes: Potential creation of multiple identical accounts
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and...
CVE-2024-30471 Apache StreamPipes: Potential creation of multiple identical accounts
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and...
CVE-2024-30471
Apache StreamPipes is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in its user self-registration component. This flaw arises from synchronization errors when accessing common resources, allowing an attacker to request the creation of multiple accounts with the sam...
Internet Bug Bounty: CVE-2024-38875: Denial-Of-Service through uncontrolled resource consumption caused by poor time complexity of strip_punctuation .
The vulnerability CVE-2024-38875 was discovered in the strippunctuation function used by the urlize and urlizetrunc filters. The function had a poor time complexity of On^2 in the worst case, which could lead to uncontrolled resource consumption when processing input with a large number of openin...
Sensitive Information Disclosure
directus is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling when using SSO providers in combination with local authentication. An attacker can determine if an email address belongs to an SSO user by observing the error message provided by...
Directus Allows Single Sign-On User Enumeration
Impact When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user...
GHSA-JGF4-VWC3-R46V Directus Allows Single Sign-On User Enumeration
Impact When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user...
CVE-2024-36122 Discourse doesn't limit reviewable user serializer payload
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta4 on the beta and tests-passed branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses settin...
CVE-2024-36122: Exposure of Sensitive Information to an Unauthorized Actor
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta4 on the beta and tests-passed branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses settin...
The vulnerability of the Microsoft Outlook email client for Windows operating systems, related to the possibility of replacing the email address, allows attackers to carry out phishing attacks.
The vulnerability of the Microsoft Outlook email client for Windows operating systems is related to the possibility of replacing the email address. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks by introducing malicious links...
Malicious code in activemodel-email-address_validator (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-6462 Malicious code in activemodel-email-address_validator (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-37897 Insufficient access control for password reset in sftpgo
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enable...
GHSA-HW5F-6WVV-XCRH SFTPGo has insufficient access control for password reset
Impact SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions e.g. expired can reset their password and log in. Patches Fixed in v2.6.1...