CVE-2020-36770

pkgpostinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files...

PT-2024-10822 · Gentoo +1 · Gentoo +1

Name of the Vulnerable Software and Affected Versions: Slurm versions through 22.05.3 Description: The issue arises from the pkg postinst in the Gentoo ebuild for Slurm, which unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the...

CVE-2023-7226

A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be...

Design/Logic Flaw

A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be...

CVE-2023-7226 meetyoucrop big-whale Admin Module all.api improper ownership management

A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be...

CVE-2023-7226 meetyoucrop big-whale Admin Module all.api improper ownership management

A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be...

4 Questions for CISOs to Reduce Threat Exposure Risk

In an ongoing effort to help security organizations gain greater visibility into threat exposure risk, we have determined four key questions every CISO should be considering based on our understanding of the recommendations of a new report from Gartner®. The report, 2024 Strategic Roadmap for...

meetyoucrop big-whale security breach

big-whale is a task scheduling platform open-sourced by Meiyu meetyoucrop. A security vulnerability exists in meetyoucrop big-whale version 1.1, which stems from the presence of an unknown function in /auth/user/all.api in the component Admin Module, which leads to ownership mismanagement via the...

PT-2024-15237 · Unknown · Meetyoucrop Big-Whale

Name of the Vulnerable Software and Affected Versions: meetyoucrop big-whale version 1.1 Description: A critical issue affects some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the id argument leads to improper ownership management. The...

WordPress WP Register Profile With Shortcode Plugin <= 3.5.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Register Profile With Shortcode Type Plugin Vulnerable versions = 3.5.9 Fixed in 3.6.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-5448 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 4d4b8ee6f41a Credits...

WordPress EventON Pro Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software EventON Pro Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6158 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b43943b2a15f Credits Francesco Carlucci Required...

WordPress Customer Reviews for WooCommerce Plugin <= 5.38.9 is vulnerable to Arbitrary File Upload

Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions = 5.38.9 Fixed in 5.38.10 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6979 Patch priority Medium CVSS severity Medium 9.8 Developer Claim ownership PSID f2b42bb42f3b Credits Artem Guzhva...

In tokenomics,sol, anyone can become admin and can at the same time alter the values of all input paramaters of the initializeTokenomics() function.

Lines of code Vulnerability details Impact This bug report is about a lack of access control checks on initializeTokenomics functions used to configure the protocol during the deployment. An attacker could exploit this vulnerability by front-running the deployment process and call...

A MALICIOUS USER CAN FRONT RUN AND EXECUTE THE Tokenomics.initializeTokenomics TRANSACTION TO BECOME THE OWNER OF THE Tokenomics CONTRACT

Lines of code Vulnerability details Impact The Tokenomics.initializeTokenomics is an external function which can be called by anyone, Since there is no access control. Hence a malicious user can front-run the valid initialization transaction and become the owner of the Tokenomics contract. This i...

The Treasury.sol contract changes the address for the different manager contract in one function call.

Lines of code Vulnerability details Impact In a case where either one of the manager addresses the tokenomics, depositiory or dispenser contracts are compromised or deprecated, attempting to replace the compromised manager contract address necessitates an overall replacement of all the other...

DEBIAN-CVE-2023-34326

The caching invalidation guidelines from the AMD-Vi specification 48882—Rev 3.07-PUB—Oct 2022 is incorrect on some hardware, as devices will malfunction see stale DMA mappings if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory range...

WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.3.0 is vulnerable to Broken Access Control

Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.3.0 Fixed in 4.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-7068 Patch priority Low CVSS severity Low 4.3 Developer Claim...

WordPress WooCommerce Conversion Tracking Plugin <= 2.0.11 is vulnerable to Broken Access Control

Software WooCommerce Conversion Tracking Type Plugin Vulnerable versions = 2.0.11 Fixed in 2.0.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52217 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 83cd471b97c1 Credits Abdi...

WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51536 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e48c62e620dc Credits Huynh Tien Si Required privilege...

WordPress Quotes for WooCommerce Plugin <= 2.0.1 is vulnerable to Broken Access Control

Software Quotes for WooCommerce Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51680 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ace2b6bbf64b Credits Abdi Pranata Required...