CVE-2024-37277 WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4...

CVE-2024-37277

CVE-2024-37277 is an Authorization Bypass via a user-controlled key affecting Paid Memberships Pro

CVE-2024-37277 WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4...

WordPress plugin Paid Memberships Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-27440 · Unknown · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro versions n/a through 3.0.4 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: Fo...

PT-2024-32887 · Sonarsource · Sonarqube

Name of the Vulnerable Software and Affected Versions: SonarSource SonarQube versions 10.4 through 10.5 before 10.6 Description: A vulnerability was discovered in the "authorizations/group-memberships" API endpoint that allows SonarQube users with the administrator role to inject blind SQL...

CVE-2024-47911

In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands...

CVE-2024-6593

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway aka Single Sign-On Agent on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit this vulnerability to retrieve...

CVE-2024-6592

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway aka Single Sign-On Agent on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected...

WordPress Paid Memberships Pro - Member Directory Add On plugin < 1.2.6 - Contributor+ Sensitive Information Disclosure and SQLi vulnerability

WordPress Paid Memberships Pro - Member Directory Add On plugin 1.2.6 - Contributor+ Sensitive Information Disclosure and SQLi vulnerability discovered by Scott Kingsley Clark in WordPress Plugin Paid Memberships Pro - Member Directory Add On versions 1.2.6...

WordPress Paid Memberships Pro - Membership Maps Add On plugin < 0.7 - Contributor+ Sensitive Information Disclosure vulnerability

WordPress Paid Memberships Pro - Membership Maps Add On plugin 0.7 - Contributor+ Sensitive Information Disclosure vulnerability discovered by Scott Kingsley Clark in WordPress Plugin Pmpro Membership Maps versions 0.7...

CVE-2024-1287 Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector...

CVE-2024-1287 Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector...

CVE-2024-1286 Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure

The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site...

WordPress Paid Memberships Pro - Member Directory Add On Plugin < 1.2.6 is vulnerable to SQL Injection

Software Paid Memberships Pro - Member Directory Add On Type Plugin Vulnerable versions 1.2.6 Fixed in 1.2.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1287 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 7039256f577b Credits Scott Kingsley Clark...

CVE-2024-38496 Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability

The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships...

Broadcom Symantec Privileged Access Management 安全漏洞

Broadcom Symantec Privileged Access Management Broadcom Symantec PAM is a security software from Broadcom, Inc. It helps prevent security breaches by protecting sensitive administrative credentials, controlling privileged user access, proactively enforcing security policies, and monitoring and...

PT-2024-28036 · Pam · Pam

Name of the Vulnerable Software and Affected Versions: PAM affected versions not specified Description: The issue allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships. Recommendations: At the moment, there is no information about a new...

CVE-2024-39875

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows authenticated, low privilege users with the 'Manage own remote connections' permission to retrieve details about other users and group memberships...

CVE-2024-39875

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows authenticated, low privilege users with the 'Manage own remote connections' permission to retrieve details about other users and group memberships...