CVE-2024-5891

A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, ...

CVE-2024-5891

CVE-2024-5891 affects Quay. If an attacker obtains the client ID of an application, they can use an OAuth token to authenticate to Quay services they otherwise should not access. The issue is limited to authentication (not authorization) and can enable access to applications via authentication-on...

CVE-2024-5891 Quay: unauthorized user may authenticate via oauth application token

A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, ...

CVE-2024-5891 Quay: unauthorized user may authenticate via oauth application token

A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, ...

CVE-2023-41240

CVE-2023-41240 concerns the WordPress plugin Pricing Deals for WooCommerce . Affected versions are up to 2.0.3.2 and the issue is described as Missing Authorization / Broken Access Control . It allows an unauthenticated user to exploit a lack of authorization (e.g., via the vtprd_ajax_clone_rule ...

CVE-2023-44234

CVE-2023-44234 affects the WordPress WP GPX Maps plugin (WP GPX Maps) up to version 1.7.08. Root cause: Missing Authorization (Broken Access Control) allows access to resources without proper permission validation. Documented severity is low (CVSS ~4.3). Public references indicate the vulnerabili...

CVE-2023-47845

CVE-2023-47845 describes a CSRF vulnerability in the WordPress plugin Grab & Save (versions

CVE-2023-51526

CVE-2023-51526 is a Missing Authorization vulnerability in the WordPress plugin Simple Staff List (affected: up to version 2.2.4). The connected data confirm the issue arises from missing authorization for specific admin actions, notably via ajax_flush_rewrite_rules and staff_member_export, allow...

CVE-2023-51537

CVE-2023-51537 is a Missing Authorization vulnerability in the WordPress plugin Awesome Support (vendor: Awesome Support) affecting versions from n/a up to and including 6.1.5 . Connected documents indicate this issue has been publicly discussed with remediation by applying a fix in later release...

CVE-2023-51671

Technical details about CVE-2023-51671 are not provided in the connected documents. The initial description notes a Missing Authorization issue affecting FunnelKit Checkout up to 3.10.3. Monitor for official patches or disclosures for concrete impact and remediation.

CVE-2023-51679

CVE-2023-51679 affects the BulkGate SMS Plugin for WooCommerce (WordPress) up to version 3.0.2. Multiple sources (NVD, RH/Red Hat, CNNVD) describe it as a Missing/Broken Authorization vulnerability stemming from lack of proper authorization validation. Reported CVSS metrics in NVD indicate CVSS 3...

CVE-2023-51680

Summary: CVE-2023-51680 affects the WordPress plugin “Quotes for WooCommerce.” The root cause is missing authorization checks leading to Broken Access Control in AJAX actions. The vulnerability exists in versions up to and including 2.0.1 and can allow manipulation of quotes by authenticated user...

CVE-2023-52117

Technical details for CVE-2023-52117 are not provided in the connected documents. According to the initial description, this is a Missing Authorization vulnerability affecting ProfileGrid

CVE-2023-52177

CVE-2023-52177 affects the WordPress plugin Integrate Google Drive by SoftLab with Missing Authorization (Broken Access Control) in versions from n/a to 1.3.3. The available sources confirm affected software and root cause, but provide no public details on exploit vectors, impact beyond what’s st...

PT-2024-37226 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A vulnerability was found in Quay, where an attacker can use an OAuth token to authenticate despite not having access to the organization from which the application was created, if they obtain...

CVE-2024-23503

CVE-2024-23503 (Ninja Tables

CVE-2023-51519

CVE-2023-51519 (Soliloquy Slider for WordPress) is represented in connected sources as a Missing Authorization/Broken Access Control vulnerability affecting Soliloquy Slider by Soliloquy, specifically versions up to and including 2.7.2. The connected enrichment references this as a Broken Access ...

CVE-2024-23521

CVE-2024-23521 concerns the WordPress plugin Happyforms. Affected: Happyforms versions up to and including 1.25.10. Root cause: Missing authorization checks enabling unauthenticated users to perform unauthorized actions. Public detail confirms a Broken Access Control vulnerability with low CVSS v...

CVE-2023-51498

CVE-2023-51498 is a Missing Authorization vulnerability (Broken Access Control) in the WordPress plugin WooCommerce Canada Post Shipping , affecting versions up to 2.8.3. The connected Red Hat advisory notes the issue and confirms a patch is available (patched). No exploit details are provided in...

CVE-2023-52217

CVE-2023-52217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin “WooCommerce Conversion Tracking.” Affected are versions up to 2.0.11; the issue stems from missing authorization controls in the plugin’s operations. The CVE entry notes a patch is available i...