Cross site request forgery (csrf)

SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiality and Integrity with no impact on Availability of the...

CVE-2024-22133

Affected product/version: SAP Fiori Front End Server 605. Vulnerability: Improper modification of approver details in the read‑only field when sending leave request information, enabling creation of requests with an incorrect approver. Impact (as stated): low impact on confidentiality and integri...

SAP Fiori Security Breach

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, delivering a consistent, innovative experience for creators and users. A security...

PT-2024-19219 · Sap · Sap Fiori Front End Server

Name of the Vulnerable Software and Affected Versions: SAP Fiori Front End Server version 605 Description: The issue allows altering of approver details on the read-only field when sending leave request information, potentially leading to the creation of requests with incorrect approvers. This...

My Calendar < 3.4.24 - Authenticated Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks depending on the permissions set by the admin PoC 1. Use any type of role as long as you permit it the action to Add Events. 2. Add...

My Calendar < 3.4.24 - Authenticated Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks depending on the permissions set by the admin 1. Use any type of role as long as you permit it the action to Add Events. 2. Add a n...

Design/Logic Flaw

The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'gambitbuildersavecontent' function in all versions up to, and including, 5.1.0. This makes it possible for...

CVE-2024-1381

CVE-2024-1381 affects the Page Builder Sandwich – Front End WordPress Page Builder Plugin. The vulnerability is a Sensitive Information Exposure in all versions up to 5.1.0, enabling authenticated users with subscriber+ privileges to extract sensitive user or configuration data. Connected sources...

CVE-2024-1285

CVE-2024-1285 affects the Page Builder Sandwich – Front End WordPress Page Builder Plugin for WordPress. It permits unauthorized modification of data via a missing capability check in gambit_builder_save_content, affecting all versions up to 5.1.0. Attackers with subscriber+ privileges can insert...

WordPress Page Builder Sandwich – Front-End Page Builder Plugin <= 5.1.0 is vulnerable to Broken Access Control

Software Page Builder Sandwich – Front-End Page Builder Type Plugin Vulnerable versions = 5.1.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1285 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID bc89ef57da60...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM. An attacker exploiting this vulnerability could set its profile picture via the front-end API using a relative file path and then download any valid file using the PFP GET API...

Why Front-End Development Matters for Online Businesses?

By Owais Sultan Front-end development, sometimes called client-side development, creates CSS, HTML, and JavaScript for online apps and sites so users… This is a post from HackRead.com Read the original post: Why Front-End Development Matters for Online Businesses?...

PT-2024-3162 · WordPress · Admin Bar Remover

Name of the Vulnerable Software and Affected Versions: Admin Bar Remover plugin for WordPress versions up to, and including, 1.0.2.2 Description: The issue is related to a missing capability check on the update form function, which allows authenticated attackers with subscriber-level access and...

Budibase Simple Admin Panel App SQL Injection Vulnerability

Budibase Simple Admin Panel App is a simple application from Budibase UK. It allows users to manipulate databases from a front-end interface. A security vulnerability exists in Budibase Simple Admin Panel App v1.0, which originates from a SQL injection vulnerability in the file...

PT-2024-12393 · Audio · Audio

Name of the Vulnerable Software and Affected Versions: Audio affected versions not specified Description: The issue is related to memory corruption in the Audio component when processing IIR config data from the AFE calibration block. Recommendations: At the moment, there is no information about ...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from an audio memory corruption when processing IIR configuration data from an AFE calibration block...

Design/Logic Flaw

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn'...

GHSA-6845-XW22-FFXV Vyper sha3 codegen bug

Summary There is an error in the stack management when compiling the IR for sha364. Concretely, the height variable is miscalculated. The vulnerability can't be triggered without writing the IR by hand. That is, it cannot be triggered from regular vyper code, it can only be triggered by using the...

Statmic CMS vulnerable to account takeover via XSS and password reset link

Impact HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects: - front-end forms with asset fields without any mime type validation - asset fields in the control panel - asset browser in the control panel Additionally, if the XSS is crafted in a specific...

CVE-2024-24570

Statamic CMS is affected by a cross-site scripting vulnerability (CVE-2024-24570) where HTML files disguised as JPEGs could be uploaded via front-end asset fields, control-panel asset fields, and the asset browser. The root cause is improper mime-type validation, enabling XSS execution by authent...