CVE-2024-34701

Summary: CVE-2024-34701 affects Miraheze’s CreateWiki MediaWiki extension. An attacker could be considered the requester for a wiki request if their local user ID on any wiki in the farm matches the requester’s local ID on the target wiki, enabling actions the requester is allowed to perform via ...

CVE-2024-34701 CreateWiki vulnerable to impersonation of wiki requester

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made...

CVE-2024-33522 Privilege escalation in Calico CNI install binary

In vulnerable versions of Calico v3.27.2 and below, Calico Enterprise v3.19.0-1, v3.18.1, v3.17.3 and below, and Calico Cloud v19.2.0 and below, an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. T...

SP Project & Document Manager <= 4.71 - Data Update via IDOR

Description The plugin is missing validation in its upload function, allowing a user to manipulate the userid to make it appear that a file was uploaded by another user PoC 1. Select to upload a file through the plugin 2. Intercept the request: Example: ------WebKitFormBoundaryX4YnPgSA4oPHlNjv...

Unspecified Vulnerability in Palo Alto Networks PAN-OS (CNVD-2024-20503)

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from a flaw in the way data received from Cloud Identity Engine CIE agents is processed, which can lead to modification of user ID...

CVE-2024-3383

A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine CIE agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your...

CVE-2024-3383

A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine CIE agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your...

CVE-2024-3383

CVE-2024-3383 affects Palo Alto Networks PAN-OS where data from Cloud Identity Engine (CIE) agents can modify User-ID groups. Affected are PAN-OS versions reported by the Nessus plugin: 10.1.x before 10.1.11, 10.2.x before 10.2.5, and 11.0.x before 11.0.3. Impact: user access may be incorrectly g...

PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)

A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine CIE agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your...

PT-2024-2902 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: PAN-OS affected versions not specified Description: A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine CIE agents enables modification of User-ID groups. This impacts user access to...

Palo Alto Networks PAN-OS 10.1.x < 10.1.11 / 10.2.x < 10.2.5 / 11.0.x < 11.0.3 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.11 or 10.2.x prior to 10.2.5 or 11.0.x prior to 11.0.3. It is, therefore, affected by a vulnerability. - A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identit...

Campcodes Online Event Management System SQL注入漏洞

Campcodes Online Event Management System is an online event management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Online Event Management System version 1.0, which originates from an unknown part of /api/process.php and results in SQL injection via the parameter...

nodejs: setuid() does not drop all privileges due to io_uring

A flaw was found in Node.js, where the setuid does not affect libuv's internal iouring operations if initialized before the call to setuid. This issue allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid...

Task Management System SQL注入漏洞

SourceCodester Task Management System is a task management system. A SQL injection vulnerability exists in PHP Task Management System version 1.0, which stems from an incorrect manipulation of the parameter userid that can lead to sql injection...

Storefront user can access history and most viewed data from matching back-office user with the same ID

Impact Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user...

UBUNTU-CVE-2024-22017

setuid does not affect libuv's internal iouring operations if initialized before the call to setuid. This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid. This vulnerability affects all users using version greater or...

Online-College-Event-Hall-Reservation-System SQL Injection Vulnerability

Online-College-Event-Hall-Reservation-System is an online college event hall reservation system by Magesh K individual developer. Designed to automate the hall booking process to eliminate manual logging and increase efficiency. Online-College-Event-Hall-Reservation-System suffers from a SQL...

CVE-2019-14782

creationtimestamp| type| source ---|---|--- 2024-03-12 15:11:37+00:00| seen| https://t.me/ctinow/205739...

BIT-SUITECRM-2021-25961 SuiteCRM - Account Takeover in Password Reset Functionality

In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id...

BIT-POSTGRESQL-2023-2455

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security...