CVE-2024-38806

Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow them to perform operations beyond their...

CVE-2024-38806

CVE-2024-38806 concerns a permission-synchronization flaw in Cloud Foundry Foundation’s UAA for version v40.17.0, where shadow/ stale group mappings can leave users with outdated access rights. Technical details from connected sources show the issue arises when UAA proxies external provider group...

CVE-2024-5321

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs...

Command Injection

org.apache.streampark:streampark is vulnerable to Command Injection. The vulnerability is caused due to insufficient input parameter validation, allowing attackers to insert commands. Exploiting this requires system-level access via user login, thereby limiting its risk due to controlled user...

Apache StreamPark: Unchecked maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

Error: "The domain/user does not have access to the farm" when Accessing the Management Console

Administrator account is not able to access the management console and it generates error, "the domain/user does not have access to the farm"...

Authentication Bypass

github.com/nats-io/nats-server is vulnerable to Authentication bypass. The vulnerability is due to a failure to enforce negative user permissions in one scenario. Attackers can exploit this by using a queue subscription on the wildcard to access denied subjects...

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

Microsoft Windows Hyper-V Privilege Escalation Vulnerability

Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges...

CVE-2024-1427

CVE-2024-1427 affects The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid (WordPress). A stored XSS exists via the section title tag attribute in all versions up to 7.7.1 due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation...

CVE-2023-25646

There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations...

CVE-2024-5685

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685

CVE-2024-5685 affects Snipe-IT (versions v4.6.17–v6.4.1). The root cause is missing authorization checks in the API endpoint that allows users with User:edit and Self:api permissions to modify group memberships, enabling promotion/demotion of users. Remediation: upgrade to v6.4.2 or later (as ref...

CVE-2024-1565

The CVE-CVE-2024-1565 corresponds to a Stored Cross-Site Scripting via the PDF Widget URL in the WordPress plugin EmbedPress (versions up to and including 3.9.10). Exploitation requires authentication at contributor level or higher; an attacker can inject arbitrary scripts on pages viewed by user...

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges...

EmbedPress < 3.9.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL

Description The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the PDF Widget URL in all versions up to, and including, 3.9.10 due to insufficient input...

SUSE CVE-2024-5742

A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privilege...

CVE-2024-1768

CVE-2024-1768 – Clever Fox WordPress plugin : The WordPress plugin Clever Fox is affected by a Stored Cross-Site Scripting vulnerability in the plugin’s info box block, arising from insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers wi...

Typo3 Information Disclosure in Backend User Interface

The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this...