1030 matches found
CVE-2024-35185 Denial of service of Minder Server with attacker-controlled REST endpoint
Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server. The REST ingester allows users to interact with REST endpoints to fetch dat...
CVE-2024-35185
CVE-2024-35185 affects Minder’s REST ingester component in Minder (pre-0.0.49). The vulnerability allows an attacker-controlled remote endpoint to respond with very large bodies, causing Minder to read the entire response into memory and potentially crash the Minder server, resulting in a DoS. Th...
CVE-2024-35185: Uncontrolled Resource Consumption
Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server. The REST ingester allows users to interact with REST endpoints to fetch dat...
Import and export users and customers < 1.24.7 - Missing Authorization via fire_cron REST endpoint
Description The plugin is vulnerable to unauthorized modification of data due to an improper capability check on the firecron function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to trigger the plugin's cron job...
CVE-2023-5041: Improper Neutralization of Special Elements used in an SQL Command
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database...
CVE-2023-5922
The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action and REST endpoint, currently disabled in the plugin have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protect...
Default credentials
The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action and REST endpoint, currently disabled in the plugin have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protect...
CVE-2023-6875
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7...
CVE-2023-6875
WordPress POST SMTP Mailer plugin (
WordPress POST SMTP Mailer 2.8.7 Authorization Bypass / Cross Site Scripting
Vulnerability Summary from Wordfence Intelligence Description: POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress = 2.8.7 – Authorization Bypass via type connect-app API Affected Plugin: POST SMTP Mailer – Email log, Delivery Failure Notifications and Be...
VulnCheck KEV: CVE-2022-0952
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as...
Jetpack < 12.7 - Improper Authorization via WPCom External Media REST endpoints
Description The Jetpack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the WPCom External Media REST permissioncallback function in versions up to and including 12.6.2. This makes it possible for authenticated attackers, with...
PT-2023-8951 · Mediawiki +2 · Mediawiki Checkuser Extension +2
Name of the Vulnerable Software and Affected Versions: MediaWiki CheckUser extension versions 1.35.12 and earlier, versions 1.36.x through 1.39.x before 1.39.5, and versions 1.40.x before 1.40.1 Description: An issue was discovered in the CheckUser extension for MediaWiki. A user can use a...
Producer Initiated Transactions in Spring Cloud Stream Kafka Applications
Other parts in this blog series Part 1: Introduction to Transactions in Spring Cloud Stream Kafka Applications This article is part 2 of the blog series in which we look at transactions in detail with Spring Cloud Stream and Apache Kafka. We saw a general introduction to transactions in the...
CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...
CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...
Information disclosure
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...
CVE-2023-30950 CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...
CVE-2023-30950 CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint...
PT-2023-23080 · Unknown · Foundry Campaigns Service
Name of the Vulnerable Software and Affected Versions: Foundry Campaigns Service affected versions not specified Description: The issue concerns an unauthenticated information disclosure in a REST endpoint. Recommendations: At the moment, there is no information about a newer version that contain...