CVE-2024-55920

CVE-2024-55920 affects TYPO3 and specifically the backend Dashboard Module . The issue is a CSRF in deep-link handling plus improper use of HTTP GET for state-changing actions. Exploitation requires an active backend session and a user-initiated visit to a malicious URL, typically via phishing, w...

CVE-2024-55923 Cross-Site Request Forgery in Indexed Search Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2025-22800

Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through = 2.9.11...

PT-2025-3191 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue is related to a template misconfiguration that causes security vulnerabilities. Recommendations: At the moment, there is no information about a newer version that contains a f...

License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data

Misconfigured license-plate-recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes by them...

Fixed in ClickHouse v25.1.5.5, 2025-01-05​

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

FAS - Users from 2-way trusted domain getting "incorrect username or password" on VDA login

Users from primary domain are able to be authenticated without issue. Users from Domain B, which is in a different forest and is trusted via 2-way trust, can authenticate with the storefront without issue. However, when launching a resource the CWA eventually loads a small window indicating the t...

CVE-2023-39994

Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember Premium: from n/a through 5.9.2...

CVE-2023-47179

Missing Authorization vulnerability in ByConsole WooODT Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through 2.4.6...

CVE-2023-45631

Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3...

PT-2025-3230 · Sonaar · Sonaar Music Mp3 Audio Player

Name of the Vulnerable Software and Affected Versions: Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar versions n/a through 5.8 Description: The issue is related to a missing authorization vulnerability in the Sonaar Music MP3 Audio Player, which allows accessing functionality...

PT-2025-3219 · Supsystic · Data-Tables-Generator-By-Supsystic

Name of the Vulnerable Software and Affected Versions: Data Tables Generator by Supsystic versions 1.10.36 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This is due to improper...

PT-2025-1496 · Wedevs · Wedevs Wp Erp

Name of the Vulnerable Software and Affected Versions: weDevs WP ERP versions 1.12.6 and earlier Description: The issue is related to a missing authorization vulnerability in weDevs WP ERP, which allows exploiting incorrectly configured access control security levels. Recommendations: For weDevs ...

CVE-2024-56217

Missing Authorization vulnerability in W3 Eden, Inc. Download Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through 3.3.03...

Vulnerability in SICK OLM

SICK received a report about a vulnerability in the SICK Support Portal supportportal.sick.com, which was hosted and operated by a third-party service provider. Due to a misconfiguration, the access restriction of a NFS Network File System storage system has failed, which resulted in temporary...

PT-2024-36649 · Torod · Torod

Name of the Vulnerable Software and Affected Versions: Torod versions n/a through 1.7 Description: The issue is caused by incorrectly configured access control security levels, allowing exploitation of missing authorization. This enables unauthorized access via misconfigured controls...

PT-2024-36645 · Unknown · Wp-Crm System

Name of the Vulnerable Software and Affected Versions: WP-CRM System versions 3.2.9.1 and earlier Description: A Missing Authorization issue in WP-CRM System allows users to exploit incorrectly configured access control security levels. This enables unauthorized access to the system...

Builder.ai Database Misconfiguration Exposes 1.29 TB of Unsecured Records

Cybersecurity researcher Jeremiah Fowler discovered a 1.2TB database containing over 3 million records of Builder.ai, a London-based AI software and app development company. Discover the risks, lessons learned, and best practices for data security...

PT-2024-36661 · Unknown · Spreadr Woocommerce

Name of the Vulnerable Software and Affected Versions: Spreadr Woocommerce versions 1.0.4 and earlier Description: A Missing Authorization issue exists in Spreadr Woocommerce, allowing users to access functions that should be restricted due to ACL misconfiguration. This enables unauthorized acces...

CVE-2020-12484

When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead to man-in-the-middle attacks...