CVE-2021-40331 Permissions problem in the Apache Ranger Hive Plugin

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from...

PT-2023-12360 · Apache · Apache Ranger Hive Plugin

Name of the Vulnerable Software and Affected Versions: Apache Ranger Hive Plugin versions 2.0.0 through 2.3.0 Description: An Incorrect Permission Assignment for Critical Resource issue was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownershi...

Apache Ranger 安全漏洞

Apache Ranger is a set of architectures from the U.S.-based Apache Foundation that implements comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

anyone can call initialize() functions which can cause lost of funds and contract ownership

Lines of code Vulnerability details Impact Most of the smart contracts have an initialize function that anyone can call as initialize function visibility is either external or public. This could lead to a race condition when the contract is deployed. At that moment a hacker or attacker could call...

WordPress URL Params Plugin < 2.5 is vulnerable to Cross Site Scripting (XSS)

Software URL Params Type Plugin Vulnerable versions 2.5 Fixed in 2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0274 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c07bdc476562 Credits Lana Codes Required privilege...

uptimed: Root Privilege Escalation

Background uptimed is a system uptime record daemon that keeps track of your highest uptimes. Description Via unnecessary file ownership modifications in the pkgpostinst ebuild phase, the uptimed user could change arbitrary files to be owned by the uptimed user at emerge-time. Impact The uptimed...

WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection

Software CM Pop-Up banners Type Plugin Vulnerable versions = 1.5.10 Fixed in 1.6.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-30750 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a1957d5dbbe6 Credits Dave Jong Patchstack Required privilege...

CVE-2023-1125

The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own...

WordPress plugin Ruby Help Desk 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress WP Visitor Statistics (Real Time Traffic) Plugin < 6.9 is vulnerable to SQL Injection

Software WP Visitor Statistics Real Time Traffic Type Plugin Vulnerable versions 6.9 Fixed in 6.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0600 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 05f734351f7a Credits Trần Quốc Trường An Required...

WordPress WP EasyPay Plugin < 4.1 is vulnerable to Cross Site Scripting (XSS)

Software WP EasyPay Type Plugin Vulnerable versions 4.1 Fixed in 4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1465 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2b3a789b9109 Credits Pablo Sanchez Required privilege...

Having RRSetWithSignature has absolute power

Lines of code Vulnerability details Impact Assuming that RRSetWithSignature is issued for Alice, Alice executes the proveAndClaim function and becomes the owner of DNS. She then transfers it to Bob. When Alice executes the proveAndClaim function again, she becomes the owner of DNS once more, and...

WordPress Depicter Slider Plugin <= 1.9.0 is vulnerable to Broken Access Control

Software Depicter Slider Type Plugin Vulnerable versions = 1.9.0 Fixed in 1.9.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-47176 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 539ee2ac709d Credits thiennv Required privilege...

Insecure Ownership Management in DNSSECImpl.sol

Lines of code Vulnerability details Impact This finding highlights a potential security risk related to the lack of safeguards when changing ownership in the DNSSECImpl.sol contract. As it stands, the current implementation allows for the owner to be set to address0, which could result in the los...

WordPress LIQUID SPEECH BALLOON Plugin < 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software LIQUID SPEECH BALLOON Type Plugin Vulnerable versions 1.2 Fixed in 1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27889 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b1811e420432 Credits Ryo Sato of BroadBa...

WordPress User IP and Location Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software User IP and Location Type Plugin Vulnerable versions = 2.2 Fixed in 2.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30780 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e801bae1a40a Credits deokhunKim Required...

The domain owner can transfer ownership of their domain to another individual and ownership of the domain can be returned

Lines of code Vulnerability details Impact The domain owner can transfer ownership of their domain by utilizing the setOwner function within the ENSRegistry.sol contract. In doing so, the original domain owner forfeits complete ownership of the domain. But, the original owner can regain ownership...

A DNS owner can sell the domain and then regain it back using a signature while he was still the owner of the domain

Lines of code Vulnerability details Impact The buying user would have spent money buying the DNS domain to the previous owner and still not have the DNS domain under their ownership. Proof of Concept A malicious user can: Build a proof for their ownership of a dns domain setting their address in...

CVE-2023-1129

The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users...

GHSA-7X6Q-3V3M-CWJG kiwi TCMS has possibility for user to update email address to unverified one

Impact In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Patches With Kiwi TC...