491 matches found
CVE-2024-54323 WordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPExpertsio New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through 2.6.2...
WordPress plugin New User Approve 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-36206 · WordPress · Wpexpertsio New User Approve
Name of the Vulnerable Software and Affected Versions: WPExpertsio New User Approve versions 2.6.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WPExpertsi...
WordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin New User Approve versions = 2.6.2...
lakeFS 安全漏洞
lakeFS is an open source tool from Treeverse Open Source that converts your object store into a Git-like repository. A security vulnerability exists in lakeFS version 1.31.1, which stems from the fact that when a new user is created with the username of a deleted user, the new user inherits all t...
CVE-2024-8042
Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect...
CVE-2024-8042 Rapid7 Insight Platform Unauthorized Empty Group Creation
Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect...
Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware
CVE-2023-20198 Exploit PoC for CVE-2023-20198 Description...
The vulnerability of the Nextcloud Notes note-taking application, which allows a hacker to access confidential information
The vulnerability of the Nextcloud Notes note-taking application lies in the ability to share the Notes folder with a new user before he enters the system. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to confidential information...
Nextcloud Security Breach
Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Notes version 4.6.0 and earlier, which stems from the fact that if an attacker manages to share a folder named...
CVE-2024-5324 XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'importsettings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
Exploit for Classic Buffer Overflow in Qnap Qts
!Profile Visitorshttps://komarev.com/ghpvc/?username=d0rb&la...
PT-2024-20577 · Traccar · Traccar
Name of the Vulnerable Software and Affected Versions: Traccar versions prior to 6.0 Description: Traccar is an open source GPS tracking system. The issue allows for path traversal and unrestricted upload of files with dangerous types. Since the system allows registration by default, attackers ca...
Cross site request forgery (csrf)
yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery CSRF. Attackers can use this to execute CSRF attacks on victims, allowing them to retrieve, modify or delete data on the...
CVE-2024-28195
The CVE-2024-28195 CSRF vulnerability affects the YourSpotify self-hosted dashboard (API and login flow). Affected versions are prior to 1.9.0, where CSRF protections were insufficient, enabling attackers to execute CSRF attacks that can retrieve, modify, or delete data on the victim instance. Re...
The vulnerability of the XWiki platform for creating collaborative web applications lies in its lack of access control mechanisms. This allows attackers to create new users.
The vulnerability of the XWiki Platform lies in its lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor to create a new user remotely...
CVE-2024-23831
LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...
CVE-2024-23831
LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...
CVE-2024-23831 Privilege escalation through CSRF attack on 'setup.pl'
LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...