2109 matches found
CVE-2024-41733
Concrete details from connected sources confirm a candidate vulnerability in SAP Commerce: an information-disclosure issue that allows an attacker to determine whether a given email is associated with a valid user account during registration or login. The impact is confined to confidentiality (lo...
CVE-2024-40480
CVE-2024-40480 affects Kashipara Online Exam System v1.0. The vulnerability is a Broken Access Control in /admin/update.php and /admin/dashboard.php that allows remote unauthenticated attackers to view the admin dashboard and delete valid user accounts via direct URL access. The issue is confirme...
CVE-2024-41432
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can...
CVE-2024-41432
CVE-2024-41432 affects Likeshop up to 2.5.7.20210811. The issue is IP spoofing via forged X-Forwarded or Client-IP headers, enabling attackers to bypass admin login lockouts, spoof server requests, and impersonate other IPs tied to user sessions. No explicit fixes or patches are provided in the c...
The vulnerability of MicroLogix 1400 programmable logic controllers’ microprogramming software, related to deficiencies in authentication procedures, allows attackers to delete user accounts.
The vulnerability of MicroLogix 1400 programmable logic controllers’ microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to delete user accounts...
CVE-2023-40539
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-40644 gitoxide's gix-path can use a fake program files location
gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...
CVE-2024-6328
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebasesmslogin' and 'firebasesmsloginv2' functions...
CVE-2024-6328
CVE-2024-6328 – MStore API (WordPress plugin) authentication bypass . The WordPress plugin MStore API – Create Native Android & iOS Apps On The Cloud is vulnerable in all versions up to 4.14.7 due to insufficient verification on the phone parameter in firebase_sms_login and firebase_sms_login_v2,...
(Pwn2Own) Synology BC500 Improper Compartmentalization Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Synology BC500 cameras. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...
GHSA-529P-JJ47-W3M3 Decidim cross-site scripting (XSS) in the admin panel
Impact The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually b...
Decidim cross-site scripting (XSS) in the admin panel
Impact The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually b...
Decidim cross-site scripting (XSS) in the admin panel
Impact The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually b...
Kaiten Security Breach
Kaiten is an employee management platform from Kaiten Inc. A security vulnerability exists in Kaiten version 57.128.8, which originates from a remote attacker who can enumerate user accounts via a crafted POST request...
CBL Mariner 2.0 Security Update: openssh (CVE-2007-2768)
The version of openssh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2007-2768 advisory. - OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the...
CVE-2024-6425
Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=&Password=&ConfirmPassword="...
CVE-2024-6425 Incorrect Provision of Specified Functionality vulnerability in MESbook
Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=&Password=&ConfirmPassword="...
CVE-2024-6425 Incorrect Provision of Specified Functionality vulnerability in MESbook
Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=&Password=&ConfirmPassword="...
CVE-2024-6425
CVE-2024-6425 – MESbook : Affected software is MESbook, version 20221021.03. A vulnerability titled “Incorrect Provision of Specified Functionality” allows an unauthenticated remote attacker to register user accounts via the /account/Register/ route using parameters such as UserName, Password, an...