2398 matches found
BIT-AIRFLOW-2021-38540 Apache Airflow: Variable Import endpoint missed authentication check
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
BIT-ARTIFACTORY-2023-42508
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body...
PT-2024-15238 · WordPress · Backup/Restore Wordpress – Backup Plugin
Name of the Vulnerable Software and Affected Versions: Backup and Restore WordPress plugin versions 1.45 and earlier Description: The issue allows unauthenticated users to access sensitive information, such as site configuration, by not protecting some log files. This poses a severe threat to...
CVE-2024-2053 Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to...
PT-2024-18677 · Unknown · Artica Proxy
Name of the Vulnerable Software and Affected Versions: The Artica Proxy administrative web application version 4.50 Description: The Artica Proxy administrative web application deserializes arbitrary PHP objects supplied by unauthenticated users, enabling code execution as the "www-data" user. Th...
Multilaser RE160V Header Manipulation Access Bypass
[email protected] Status: RO Content-Length: 5433 Lines: 153 =====Tempest Security Intelligence - Security Advisory - CVE-2023-38944======= Access Control Bypass in Multilaser routers' Web Management Interface Author: Vinicius Moraes =====Table of...
SolarWinds Security Event Manager Code Issue Vulnerability
SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds, Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A code issue vulnerability exists in SolarWinds Security Event Manager that stems from allowing an unauthenticated user to abuse...
PT-2024-15805 · Envo · Elementor Templates & Widgets For Woocommerce
Name of the Vulnerable Software and Affected Versions: The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress versions up to and including 1.4.4 Description: The issue is due to missing or incorrect nonce validation on the ajax theme activation function, making it possible...
Remote code execution
UNSUPPORTED WHEN ASSIGNED Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially thi...
Ultimate Member 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Description The plugin does not sanitize and escape the sorting parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks when the "Enable custom table for usermeta" option is enabled. PoC Requirement: "Enable custom table for usermeta" option t...
WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Admin side data storage for Contact Form 7 Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1777 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 54ff6d4bf8b9...
CVE-2023-26586
Uncaught exception for some IntelR PROSet/Wireless and IntelR KillerTM Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access...
CVE-2023-50292
A flaw was found in Apache Solr. The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, it may load untrusted configSets, which can allow an unauthenticated user to load external libraries when used in the Schema Designer. This iss...
Design/Logic Flaw
Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configu...
CVE-2023-50292 Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users
Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configu...
CVE-2023-6963
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting 'g-recaptcha-response' from the 'data' array...
Design/Logic Flaw
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be access...
phpMyFAQ Security Vulnerabilities
phpMyFAQ is a multilingual, fully database-driven FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in versions prior to phpMyFAQ 3.2.5 that stems from allowing any unauthenticated participant to abuse the application to send arbitrary emails to a large number...
Clinics Patient Management System 1.0 - Unauthenticated Code Execution Vulnerability
Exploit Title: Clinic's Patient Management System 1.0 - Unauthenticated RCE Exploit Author: Oğulcan Hami Gül Vendor Homepage: https://www.sourcecodester.com/php-clinics-patient-management-system-source-code Software Link:...