7308 matches found
Import and export users and customers < 1.24.7 - Missing Authorization via fire_cron REST endpoint
Description The plugin is vulnerable to unauthorized modification of data due to an improper capability check on the firecron function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to trigger the plugin's cron job...
CVE-2024-23687
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines...
Hardcoded credentials
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines...
CVE-2024-23687 FOLIO mod-data-export-spring Hard-Coded Credentials
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines...
CVE-2024-23687 FOLIO mod-data-export-spring Hard-Coded Credentials
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines...
CVE-2024-23687
CVE-2024-23687 affects the FOLIO module-data-export-spring. The issue arises from hard-coded credentials in the module, allowing unauthenticated access to critical APIs and enabling modification of user data, configurations (including single sign-on), and fees/fines. Affected versions are before ...
CVE-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...
CVE-2023-28900
Summary (CVE-2023-28900) : The Skoda Automotive cloud backend (Skoda Connect service) is affected by a Broken Access Control vulnerability that allows disclosure of nicknames and other user identifiers by supplying an arbitrary vehicle VIN number. The root cause is improper access control on the ...
CVE-2024-20272
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a...
CVE-2022-4962 Apollo Configuration Center users improper authorization
A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...
CVE-2022-4962 Apollo Configuration Center users improper authorization
A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been...
CVE-2023-49098
CVE-2023-49098 affects the Discourse-Reactions plugin for Discourse. Data about a user’s reaction notifications could be exposed; this was mitigated by patch commit 2c26939. The CVSSv3.1 base metrics from the record are: AV:N/AC:L/PR:L/UI:R/S:U, Confidentiality Impact: Low, Integrity/Availability...
CVE-2024-21589 Paragon Active Assurance Control Center: Information disclosure vulnerability
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0...
CVE-2023-6504 Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppbtoolboxusermetahandler function in all versions up to, and including, 3.10.7. This makes it...
Improper Authorization
pimcore/customer-management-framework-bundle is vulnerable to Improper Authorization. The vulnerability is caused due to improper authorization checks within DuplicatesController.php. This allows authenticated and unauthorized user to access the list of potential duplicate users and see their dat...
Kashipara Food Management System Cross-Site Scripting Vulnerability (CNVD-2024-13474)
Kashipara Food Management System is a food management system from Kashipara. A cross-site scripting vulnerability exists in version 1.0 of the Kashipara Food Management System, which stems from the lack of effective filtering and escaping of user-supplied data in the partyname parameter of the...
CVE-2023-42929
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access protected user data...
CVE-2023-42929
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access protected user data...