Insufficient Session Expiration

zfr/zfr-oauth2-server-module is vulnerable to Insufficient Session Expiration. The vulnerability is due to a lack of token validation for expiration and validity, allowing users to potentially use invalidated authentication credentials...

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Overview Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only...

CVE-2024-4284

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

CVE-2024-4284 Denial of Service in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

CVE-2024-4284

CVE-2024-4284 affects mintplex-labs/anything-llm (versions prior to 1.0.0). The vulnerability allows a DoS by changing a user’s id to 0, enabling a manager/admin to render a target account inaccessible and cause uncontrolled resource consumption. Root cause: lack of input validation/sanitization ...

CVE-2024-4284 Denial of Service in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

Session Fixation

laravel/framework is vulnerable to Session Fixation. The vulnerability is due to ineffective token validation allowing malicious users to maintain access even after the actual user's logout or password reset...

Exploit for Code Injection in Crushftp

Exploit Code for CVE-2024-4040 Overview This exploit code t...

PT-2024-25446 · Jegstudio · Jegstudio Financio

Name of the Vulnerable Software and Affected Versions: Jegstudio Financio versions 1.1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Jegstudio Financio. This issue allows an attacker to perform unintended actions on a user's account. The estimated number of potentiall...

GHSA-7FPJ-9HR8-28VH Keycloak vulnerable to impersonation via logout token exchange

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

PT-2024-11925 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access...

keycloak: impersonation via logout token exchange

A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

PT-2024-24398 · Unknown · Nose Graze Novelist

Name of the Vulnerable Software and Affected Versions: Nose Graze Novelist versions through 1.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that t...

PT-2024-24577 · Unknown · Awp Classifieds

Name of the Vulnerable Software and Affected Versions: AWP Classifieds versions n/a through 4.3.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that t...

PT-2024-24393 · Seedprod · Seedprod Coming Soon Page

Name of the Vulnerable Software and Affected Versions: SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd versions through 6.15.20 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user int...

PT-2024-24284 · Etoile · Etoile Web Design Ultimate Product Catalogue

Name of the Vulnerable Software and Affected Versions: Etoile Web Design Ultimate Product Catalogue versions through 5.2.15 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions o...

PT-2024-24063 · Favicon · Favicon

Name of the Vulnerable Software and Affected Versions: Favicon versions 1.3.29 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user...

PT-2024-24297 · Unknown · Live Composer

Name of the Vulnerable Software and Affected Versions: Page Builder: Live Composer versions 1.5.35 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-24300 · Userswp · Userswp

Name of the Vulnerable Software and Affected Versions: UsersWP versions prior to 1.2.6 Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

PT-2024-23471 · Unknown · Lws Optimize

Name of the Vulnerable Software and Affected Versions: LWS Optimize versions 1.9.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...