PT-2024-39733 · WordPress · Wpschoolpress

Name of the Vulnerable Software and Affected Versions: The School Management System – WPSchoolPress plugin for WordPress versions up to, and including, 2.2.10 Description: The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate ...

Autolab Misconfigured Reset Password Permissions

Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. Patches This is fixed in v3.0.1. Workarounds No workarounds. For more information If you have any questions or comments about this...

GHSA-V46J-H43H-RWRM Autolab Misconfigured Reset Password Permissions

Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. Patches This is fixed in v3.0.1. Workarounds No workarounds. For more information If you have any questions or comments about this...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

CVE-2024-49376

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376

Autolab CVE-2024-49376 affects version 3.0.0 and involves a misconfiguration of reset password permissions for email-based accounts. The issue could allow users with insufficient privileges to reset passwords and potentially access privileged users’ accounts. It is fixed in version 3.0.1. Remedia...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their...

CVE-2024-9302

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verifyotpforgotpassword and updatepassword functions not having enough controls to preve...

CVE-2024-9302

CVE-2024-9302 affects the WordPress plugin App Builder – Create Native Android & iOS Apps On The Flight, versions up to 5.3.7. The vulnerability enables privilege escalation/account takeover via weak OTP handling in verify_otp_forgot_password() and update_password(), allowing unauthenticated atta...

CVE-2024-9109 UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteoauthdata function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers,...

CVE-2024-9109 UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteoauthdata function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers,...

Admin account takeover due to allowed excessive guessing attempts for password reset code

This report is not public...

Admin user account takeover due to password reset code not being checked on the backend

This report is not public...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

PT-2024-39557 · WordPress · The App Builder – Create Native Android & Ios Apps On The Flight

Name of the Vulnerable Software and Affected Versions: The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions up to, and including, 5.3.7 Description: The issue is related to privilege escalation via account takeover. This is due to the verify otp forgot...

Autolab 授权问题漏洞

Autolab is a course management service open-sourced by Autolab. It supports automatically graded programming assignments. An authorization issue vulnerability exists in Autolab version 3.0.0 that stems from a misconfiguration of the reset password permission...