OPENSUSE-SU-2024:14138-1 python310-django-registration-3.3-2.2 on GA media

These are all security issues fixed in the python310-django-registration-3.3-2.2 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the Jenkins Bitbucket Branch Source Plugin, related to the disclosure of information through registration files, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Jenkins Bitbucket Branch Source Plugin is related to the disclosure of information through registration files. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Jenkins Structs Plugin, related to the disclosure of information through registration files, allows a perpetrator to gain unauthorized access to the protected information.

The vulnerability of the Jenkins Structs Plugin is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2023-40356 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

CVE-2024-6069

The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregisterinstalladdon function in...

CVE-2024-39597

SAP Commerce contains an authorization issue where an attacker can abuse the Forgot Password flow to gain access to a Composable Storefront B2B site with early login/registration enabled, without merchant approval. If the site is not configured as isolated, access may extend to other non-isolated...

PT-2024-37363 · WordPress · Registration Forms

Name of the Vulnerable Software and Affected Versions: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress versions up to, and including, 3.8.3.4 Description: The issue allows authenticated...

PT-2024-9568 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: A series of related high-severity vulnerabilities in Veeam Backup & Replication enables remote code execution RCE as the service account and extraction of sensitive...

WordPress plugin Registration Forms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Critical Unpatched Flaws Disclosed in Popular Gogs Open-Source Git Service

Four unpatched security flaws, including three critical ones, have been disclosed in the Gogs open-source, self-hosted Git service that could enable an authenticated attacker to breach susceptible instances, steal or wipe source code, and even plant backdoors. The vulnerabilities, according to...

The vulnerability of ASUS RT-N12+ B1 router’s microprogramming software, related to the storage of passwords in an unencrypted form, allows a intruder to gain unauthorized access to protected information.

The vulnerability of ASUS RT-N12+ B1 router’s microprogramming software is related to deficiencies in the protection of registration data. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Webinar Alert: Learn How ITDR Solutions Stop Sophisticated Identity Attacks

Identity theft isn't just about stolen credit cards anymore. Today, cybercriminals are using advanced tactics to infiltrate organizations and cause major damage with compromised credentials. The stakes are high: ransomware attacks, lateral movement, and devastating data breaches. Don't be caught...

The vulnerability of the Track Viewer Client component of the software for calculating positions of individual RTLS transponders from the SIMATIC RTLS Locating Manager allows a intruder to gain increased privileges.

The vulnerability of the Track Viewer Client component of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager system is related to insufficient protection of registration data. Exploiting this vulnerability could allow attackers to increase...

MESbook Specified Function Provisioning Error Vulnerability

MESbook is a web-based system from MESbook Inc. connects to factory machines and converts data into information for real-time management. MESbook has a Specified Function Provisioning Error vulnerability that can be exploited by an attacker to register a user account without authentication...

The vulnerability of the “Report Clients” component of the software for calculating positions of individual RTLS transponders from SIMATIC RTLS Locating Manager allows a violator to increase their privileges.

The vulnerability of the “Report Clients” component of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to insufficient protection of registration data. Exploiting this vulnerability can allow attackers to increase their...

The vulnerability of the web server used by the monitoring and network traffic analysis software in SINEC Traffic Analyzer allows a hacker to gain unauthorized access to passwords and increase their privileges.

The vulnerability of the web server used by the monitoring and network traffic analysis software in SINEC Traffic Analyzer is related to insufficient protection for registration data. Exploiting this vulnerability can allow attackers to obtain unauthorized access to passwords and increase their...

CVE-2024-39891

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...

CVE-2024-6099

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'checkvalidatefields' function in the checkout. This makes it possible for unauthenticated...

CVE-2024-6099

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'checkvalidatefields' function in the checkout. This makes it possible for unauthenticated...

CVE-2024-6088

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user...