74 matches found
Rising Technosoft CAP back office application 安全漏洞
Rising Technosoft CAP back office application is a back office application from Rising Technosoft India. A security vulnerability exists in the Rising Technosoft CAP back office application that stems from improper authentication checks in the API endpoint, allowing an unauthenticated, remote...
CVE-2024-9522
The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajaxmasqlogin' function. This makes it possible for authenticated attackers, with subscriber-level...
| Citrix Workspace App 24.x SSON fails and ssonsvr.exe not running on client
SSON fails with CWA 2402 and 2405.10 The logon to a session stops at the "other user" screen . It is also noticed that the ssonsvr.exe process is not running on the client...
PT-2024-29388 · Unknown · Manage Bank Statement Reprocessing Rules
Name of the Vulnerable Software and Affected Versions: Manage Bank Statement ReProcessing Rules affected versions not specified Description: The issue is related to insufficient authorization checks for authenticated users, leading to potential escalation of privileges. An attacker can exploit th...
UBUNTU-CVE-2024-25983
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available e.g., on their profile page...
Vulnerabilities fixed in Microsoft Dynamics
Microsoft has fixed vulnerabilities in Dynamics. A malicious party could exploit the vulnerabilities to launch a Cross-Site Scripting attack. Such an attack can lead to execution of arbitrary code in the browser of the victim, or access sensitive data in the context of the victim's browser of the...
PT-2023-27270 · Google · Android
Name of the Vulnerable Software and Affected Versions: NotificationConversationInfo.java affected versions not specified Description: The issue is related to a logic error in the code of NotificationConversationInfo.java, specifically in the mOnDone method. This error could allow access to app...
CVE-2023-5766
A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another windows user session on the same host via a specially crafted TCP packet...
CVE-2023-32654
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.5. A user may be able to read information belonging to another user...
ROS-20230628-01
The Nextcloud server vulnerability is related to a lack of brute force protection at the password reset endpoint. Exploitation of the vulnerability could allow an attacker acting remotely to compromise the password reset links. password. The Nextcloud server vulnerability is related to the fact...
CVE-2023-23469
IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 244504...
pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not b...
CVE-2022-22314
IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 217371...
CVE-2021-20551
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149...
CVE-2021-41802
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4...
dovecot: IMAP hibernation function allows mail access
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages and path disclosure...
Apple macOS Catalina Login Window Information Disclosure Vulnerability
Apple macOS Catalina is a specialized operating system developed by Apple Inc. for Mac computers. An information disclosure vulnerability exists in the login window of macOS Catalina versions prior to 10.15.6. An attacker can exploit this vulnerability to log in to other user accounts...
wagtail-2fa authorization issue vulnerability
wagtail-2fa is a two-factor authentication software package. An authorization issue vulnerability exists in versions prior to wagtail-2fa 1.4.1, which stems from the program's failure to request specific permissions for the view and delete functions of another user's 2FA device, which can be...
CVE-2019-1583
Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlock user with Operator capabilities to escalate privileges to that of another user. Active interaction with an affected component is required for the payload to execute on the...