7308 matches found
CVE-2024-51989 Cross-site Scripting (XSS) Vulnerability in PasswordPusher
Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting XSS vulnerability was identified in the PasswordPusher application, affecting versions v1.41.1 through and including v.1.48.0. The issue arises from an un-sanitized parameter...
CVE-2024-51989
The CVE-2024-51989 entry describes a cross-site scripting (XSS) vulnerability in PasswordPusher, affecting versions v1.41.1 through v1.48.0. The root cause is an unsanitized parameter that enables injection of malicious JavaScript. Affected deployments include self-hosted PasswordPusher installat...
Svakom Siime Eye 安全漏洞
Svakom Siime Eye is a smart home device from Svakom USA. A security vulnerability exists in Svakom Siime Eye version 14.1.00000001.3.330.0.0.3.14, which originates from the fact that when a backup file is created through the web interface, information about all users can be found in plaintext in...
Flaw in Right-Wing ‘Election Integrity’ App Exposes Voter-Suppression Plan and User Data
A bug that WIRED discovered in True the Vote’s VoteAlert app revealed user information—and an election worker who wrote about carrying out an illegal voter-suppression scheme...
The vulnerability of the software’s user data loading function for running large language models (LLMs) like ChuanhuChatGPT allows a perpetrator to execute arbitrary code.
The vulnerability of the software’s user data loading function for running large language models like ChuanhuChatGPT is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
Access control vulnerable to user data deletion by anonynmous users
Impact Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. Patches The problem is fixed in version 7.2. Workarounds The problem can be fixed by adding dataroles = to AccessControl.userfolder.UserFolder. References...
CVE-2024-51734
CVE-2024-51734 affects Zope AccessControl prior to version 7.2, where anonymous users can delete data in AccessControl.userfolder.UserFolder, potentially disrupting privileged access. The issue is fixed in 7.2; a workaround is to set data__roles__ = () on the UserFolder. No exploitation details a...
CVE-2024-51734 User data deletion by anoynmous users in Zope
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...
Zope AccessControl 访问控制错误漏洞
Zope AccessControl is the common security framework used in Zope from the Zope Foundation. An access control error vulnerability exists in Zope AccessControl versions prior to 7.2, which stems from an attacker being able to delete user data maintained by AccessControl.userfolder.UserFolder, which...
PT-2024-34872
Name of the Vulnerable Software and Affected Versions Zope AccessControl versions prior to 7.2 Description The issue allows anonymous users to delete the user data maintained by an AccessControl.userfolder.UserFolder, which may prevent any privileged access. Recommendations For versions prior to...
Access control vulnerable to user data deletion by anonynmous users
Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access...
CVE-2024-49770 oak's path traversal allows transfer of hidden files within the served root directory
oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default oak does not allow transferring of hidden files with Context.send API. However, prior to version 17.1.3, this can be bypassed by encoding / as its URL encoded...
oak 安全漏洞
oak is a middleware framework from oak open source. A security vulnerability exists in oak versions prior to 17.1.3. An attacker exploiting the vulnerability can read sensitive user data or gain access to server secrets...
CVE-2024-10399
CVE-2024-10399 affects the WordPress plugin Download Monitor (versions ≤ 5.0.13). The issue is a missing capability check in ajax_search_users, allowing authenticated attackers with Subscriber+ privileges to perform unauthorized data modifications and to obtain site usernames and emails. The vuln...
CVE-2024-7474 IDOR in lunary-ai/lunary
In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference IDOR vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access...
CVE-2024-7474
In lunary-ai/lunary v1.3.2, CVE-2024-7474 describes an Insecure Direct Object Reference (IDOR) vulnerability where an attacker can view or delete external users by tampering with the id parameter in the request URL. The issue stems from inadequate checks on id, enabling unauthorized access to ext...
Lunary 访问控制错误漏洞
lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from not properly restricting permissions to update the SAML configuration. An attacker could use this vulnerability to modify the authentication process and steal user...
WordPress plugin Masteriyo LMS 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...
