CVE-2024-5810 WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials

The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for...

WordPress WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials vulnerability

Improper Authorization due to use of Hardcoded Credentials vulnerability discovered by Lucio Sá in WordPress Plugin WP2Speed Faster versions = 1.0.1...

CVE-2024-39597 [CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce

In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as isolated site, this ca...

PT-2024-7956 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.2 SP1 Description: The issue is related to improper authorization. It allows a remote attacker to gain unauthorized access to participant groups they should not have access to. The vulnerabili...

PT-2024-4972 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 On-Premises affected versions not specified Description: The issue is related to improper authorization in the local software tool for resource planning in Microsoft Dynamics 365 On-Premises. Exploitation of this issue...

Mattermost Improper Authorization Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an improper authorization vulnerability. An attacker could exploit the vulnerability to cause a remote cluster token to be retrieved via a timing attack during a remote cluster...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an improper authorization vulnerability. An attacker could exploit the vulnerability to cause a remote cluster token to be retrieved via a timing attack during a remote cluster...

Medium: sssd

Issue Overview: A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately. CVE-2023-3758 Affected Packages: sssd Issue Correction: Run dn...

Elastic Cloud Enterprise 3.7.2 Security Update (ESA-2024-18)

ECE Improper Authorization ESA-2024-18 It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges. Affected Versions: ECE versions after 3.0.0 and...

WAVLINK WN551K1 live_mfg.shtml Interface Information Disclosure Vulnerability

The WAVLINK WN551K1 is a wireless router from China's RuiYin Technology WAVLINK. The WAVLINK WN551K1 suffers from an information disclosure vulnerability that stems from improper authorization of the livemfg.shtml interface, which can be exploited by an attacker to obtain sensitive router...

CVE-2024-3959 Improper Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user...

CVE-2024-6323

Removed by vendor...

CVE-2024-6323 Improper Isolation or Compartmentalization in GitLab

Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project...

EulerOS 2.0 SP11 : sssd (EulerOS-SA-2024-1847)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...

PT-2024-6675 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.11 through 16.11.4 GitLab EE versions 17.0 through 17.0.2 GitLab EE versions 17.1 through 17.1.0 Description: The issue is related to improper authorization in the global search function, allowing an attacker to leak the...

WAVLINK WN551K1 安全漏洞

The WAVLINK WN551K1 is a wireless router from China's RuiYin Technology WAVLINK. The WAVLINK WN551K1 suffers from an information disclosure vulnerability that stems from improper authorization of the livecheck.shtml interface, which can be exploited by an attacker to obtain sensitive router...

WAVLINK WN551K1 安全漏洞

The WAVLINK WN551K1 is a wireless router from China's RuiYin Technology WAVLINK. The WAVLINK WN551K1 suffers from an information disclosure vulnerability that stems from improper authorization of the livemfg.shtml interface, which can be exploited by an attacker to obtain sensitive router...

WordPress License Manager for WooCommerce plugin <= 3.0.6 - Improper Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Improper Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Lucio Sá in WordPress Plugin License Manager for WooCommerce versions = 3.0.6...

CVE-2024-35298

Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...

CVE-2024-35298

Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...