CVE-2024-8269 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the...

WordPress MStore API plugin <= 4.15.3 - Unauthorized User Registration vulnerability

Unauthorized User Registration vulnerability discovered by wesley wcraft in WordPress Plugin MStore API versions = 4.15.3...

CVE-2021-22509 Handling of sensitive data in process memory in NetIQ Advance Authentication

A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authentication before 6.3.5.1...

CVE-2021-22509 Handling of sensitive data in process memory in NetIQ Advance Authentication

A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authentication before 6.3.5.1...

CVE-2024-40884

Mattermost versions 9.5.x = 9.5.7, 9.10.x = 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL...

CVE-2024-25633 In eLabFTW, if administrators can create users, users can too

eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts ...

CVE-2024-39418 Adobe Commerce | Improper Authorization (CWE-285)

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivi...

CVE-2024-39417 An unauthorized user can export the Shipping Report

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information...

CVE-2024-39416 Unauthorized user can export Orders Sale Report

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information...

CVE-2024-41730 Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availabilit...

HackerOne: Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member

The report described a vulnerability that allowed access to limited confidential information of a private program by ex-reporters, report participants, and ex-staff members of the program. The vulnerability was due to an endpoint that exposed details about the private program, including its...

CVE-2024-6490

CVE-2024-6490 concerns the WordPress Master Slider plugin. Multiple sources confirm a CSRF vulnerability in Master Slider versions up to 3.9.10 that lets an unauthenticated attacker manipulate requests on behalf of a logged-in user, potentially deleting all sliders in the plugin. Affected compone...

CVE-2022-32759

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 uses insufficient session expiration which could allow an unauthorized user to obtain sensitive information. IBM X-Force ID: 228565...

The vulnerability of the SINEMA Remote Connect VPN service lies in the insecure management of privileges, allowing a malicious actor to create a user with administrator privileges.

The vulnerability of the SINEMA Remote Connect VPN service relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to create a user with administrator privileges...

CVE-2024-41121

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

CVE-2024-36451

Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpage may be altered,...

CVE-2024-36451

Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpage may be altered,...

CVE-2024-39866

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to upload backup files to create a user with...

CVE-2024-39866

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to upload backup files to create a user with...

CVE-2024-39866

CVE-2024-39866 affects Siemens SINEMA Remote Connect Server (all versions prior to V3.2 SP1). The vulnerability is caused by privilege-related flaws in the backup-upload workflow: if an attacker can access the backup encryption key and upload backups, they can create a user with administrative pr...