VulnCheck KEV: CVE-2022-0952

The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as...

Jetpack < 12.7 - Improper Authorization via WPCom External Media REST endpoints

Description The Jetpack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the WPCom External Media REST permissioncallback function in versions up to and including 12.6.2. This makes it possible for authenticated attackers, with...

PT-2023-8951 · Mediawiki +2 · Mediawiki Checkuser Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki CheckUser extension versions 1.35.12 and earlier, versions 1.36.x through 1.39.x before 1.39.5, and versions 1.40.x before 1.40.1 Description: An issue was discovered in the CheckUser extension for MediaWiki. A user can use a...

Producer Initiated Transactions in Spring Cloud Stream Kafka Applications

Other parts in this blog series Part 1: Introduction to Transactions in Spring Cloud Stream Kafka Applications This article is part 2 of the blog series in which we look at transactions in detail with Spring Cloud Stream and Apache Kafka. We saw a general introduction to transactions in the...

CVE-2023-30950

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...

CVE-2023-30950

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...

Information disclosure

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...

CVE-2023-30950 CVE-2023-30950

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...

CVE-2023-30950 CVE-2023-30950

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...

Palantir Foundry Security Breach

Palantir Foundry is a business process management platform from US-based Palantir. A security vulnerability exists in Foundry Campaigns versions prior to 0.623.0 that stems from an information disclosure vulnerability in the rest endpoint...

CVE-2023-30950: Authentication Bypass by Spoofing

The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...

PT-2023-23080 · Unknown · Foundry Campaigns Service

Name of the Vulnerable Software and Affected Versions: Foundry Campaigns Service affected versions not specified Description: The issue concerns an unauthenticated information disclosure in a REST endpoint. Recommendations: At the moment, there is no information about a newer version that contain...

WordPress plugin Tutor LMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2022-46407

Ericsson Network Manager ENM, versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection can lead to redirection of the submitted request to domain out of control of ENM deployment. The attacker would need admin/elevated access to...

CVE-2022-46407

Ericsson Network Manager ENM, versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection can lead to redirection of the submitted request to domain out of control of ENM deployment. The attacker would need admin/elevated access to...

CVE-2022-46407

Ericsson Network Manager ENM, versions prior to 22.2, contains a vulnerability in the REST endpoint “editprofile” where Open Redirect HTTP Header Injection can lead to redirection of the submitted request to domain out of control of ENM deployment. The attacker would need admin/elevated access to...

Design/Logic Flaw

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, a...

CVE-2023-35151

CVE-2023-35151 (XWiki Platform) affects XWiki Platform versions 7.3-milestone-1 through 14.4.7, where any user can call a REST endpoint and obtain obfuscated passwords, even if mail obfuscation is enabled. The issue has been patched in 14.4.8, 14.10.6, and 15.1. No public workaround is documented...

CVE-2023-35151

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, a...

CVE-2023-35151 XWiki Platform may show email addresses in clear in REST results

XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, a...