PT-2023-6481 · Lightdash · Lightdash

Name of the Vulnerable Software and Affected Versions: Lightdash versions prior to 0.510.3 Description: The issue is related to incorrect restriction of a directory path name with limited access. This can allow a remote attacker to gain unauthorized access to protected information. The...

PT-2023-14629 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v018 Description: An issue allows a Bypass of Two-Factor Authentication for SAML Users. This can occur under the "/login/backup code" endpoint and the "/api/v1/vdeskintegration/challenge" endpoint...

PT-2023-14631 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v018 Description: An issue exists in the software due to Broken Access Control. This issue affects several API endpoints: "/api/v1/vdeskintegration/saml/user/createorupdate",...

GHSA-JJM5-5V9V-7HX2 org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticate endpoints

Impact It was possible to inject some code using the URL of authenticate endpoints, e.g.: https://hostname/xwiki/authenticate/wiki/xwiki%22onload=%22alertorigin%22/resetpassword This vulnerability was present in recent versions of XWiki: - 13.10.8+ - 14.4.3+ - 14.6+ Patches This problem has been...

CVE-2023-26120

This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...

CVE-2022-4938

The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying...

Cross site request forgery (csrf)

The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying...

CVE-2022-4938 WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery

The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying...

CVE-2022-4938

CVE-2022-4938 (WCFM Frontend Manager for WordPress) : The vulnerability is a Cross-Site Request Forgery (CSRF) in versions up to and including 6.6.0. It arises from missing nonce checks on numerous AJAX actions, enabling unauthenticated attackers to induce a site administrator to perform actions ...

WildFly: possible information disclosure

A flaw was found in WildFly. This flaw allows an attacker to see deployment names, endpoints, and any other data the trace payload may contain...

PT-2023-15923 · WordPress · Wcfm Frontend Manager

Name of the Vulnerable Software and Affected Versions: WCFM Frontend Manager plugin for WordPress versions up to and including 6.6.0 Description: The issue allows authenticated attackers with minimal permissions to perform various actions due to missing capability checks on several AJAX actions...

GHSA-X263-HP5C-P2RJ Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery

OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials. Additionally, these endpoints do not...

Server-side Request Forgery (SSRF)

Overview org.openapitools:openapi-generator-online is an a Spring Boot Server application which hosts a client/server generator API. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the API endpoints /api/gen/clients/language and /api/gen/servers/framework...

PT-2023-23726 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud server versions 24.0.0 through 24.0.10 Nextcloud server versions 25.0.0 through 25.0.4 Nextcloud server versions prior to 26.0.0 Description: The issue is related to missing brute-force protection on the WebDAV endpoints via the bas...

GHSA-HWC3-3QH6-R4GG HashiCorp Vault's PKI mount vulnerable to denial of service

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault...

Denial of service

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault...

CVE-2023-0665

HashiCorp Vault’s PKI mount issuer endpoints were vulnerable to insufficient access control, allowing a remote attacker to cause a denial of service by removing an issuer or altering issuer metadata. The defect specifically affects the PKI issuer management surface but does not impact private key...

Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

Summary Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerabilit...

CVE-2022-47529

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protectio...

Jenkins Plugins OctoPerf Load Testing 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...