BIT-SUITECRM-2021-25961 SuiteCRM - Account Takeover in Password Reset Functionality

In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id...

BIT-POSTGRESQL-2023-2455

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security...

GLiNet - Router Authentication Bypass

DZONERZY Security Research GLiNet: Router Authentication Bypass ======================================================================== Contents ======================================================================== 1. Overview 2. Detailed Description 3. Exploit 4. Timeline...

CVE-2024-27692

creationtimestamp| type| source ---|---|--- 2024-03-01 18:31:38+00:00| seen| https://t.me/ctinow/197879...

GHSA-Q76R-7P4Q-MQPW

creationtimestamp| type| source ---|---|--- 2024-03-01 00:37:00+00:00| seen| https://t.me/ctinow/197169...

GHSA-45M2-8Q7F-93WV

creationtimestamp| type| source ---|---|--- 2024-02-29 21:26:56+00:00| seen| https://t.me/ctinow/197020...

CVE-2014-2902

creationtimestamp| type| source ---|---|--- 2024-02-26 09:12:05+00:00| seen| https://t.me/ctinow/193176...

CVE-2024-21812

creationtimestamp| type| source ---|---|--- 2024-02-20 17:25:45+00:00| seen| https://t.me/ctinow/188758 2024-02-21 14:29:50+00:00| seen| https://t.me/arpsyndicate/3808...

GHSA-3787-6PRV-H9W3

creationtimestamp| type| source ---|---|--- 2024-02-16 17:12:46+00:00| seen| https://t.me/ctinow/186520 2025-02-13 19:18:22+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4319...

Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

Description The plugin does not prevent user with at least the contributor role from leaking other users' sensitive metadata. PoC As a contributor, - Add shortcode to any post and specify/guess any user ID and meta key and save - Preview the post and see custom field value outputs from any user...

CVE-2022-22506

IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants. IBM X-Force ID: 227293...

CVE-2023-41703

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avo...

Code injection

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avo...

CVE-2023-41703

User ID references at mentions in document comments were not correctly sanitized. Script code could be injected to a users session when working with a malicious document. Please deploy the provided updates and patch releases. User-defined content like comments and mentions are now filtered to avo...

PT-2024-12961 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue arises from the improper sanitization of User ID references at mentions in document comments, allowing script code to be injected into a user's session when working with a...

GHSA-8V28-3G86-CHJ5

creationtimestamp| type| source ---|---|--- 2024-02-08 19:36:40+00:00| seen| https://t.me/ctinow/181586...

Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access

Description The plugin does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. e.g. draft, private, pending review, pw-protected, and trashed events. 1. ADMIN: Install Event Tickets 2. ADMIN: Install Event Tickets Plus...

CVE-2018-21030

creationtimestamp| type| source ---|---|--- 2024-02-01 09:07:07+00:00| seen| https://t.me/ctinow/177405...

CVE-2024-1006

A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument NodUserId/NodUserToken leads to improper...

Sichuan Yougou Technology KuERP License Issue Vulnerability

Sichuan Yougou Technology KuERP is an e-commerce platform from Sichuan Yougou Technology, a Chinese company. An authorization issue vulnerability exists in Sichuan Yougou Technology KuERP 1.0.4 and earlier versions, which stems from a security issue in the checklogin function of...