CVE-2024-52005 The sideband payload is passed unfiltered to the terminal in git

Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the...

CVE-2024-13070

A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/updateusers.php of the component Update User Page. The manipulation of the argument userupd leads to sql injectio...

CodeAstro Online Food Ordering System 注入漏洞

CodeAstro Online Food Ordering System is an online food ordering system from CodeAstro, Inc. An injection vulnerability exists in CodeAstro Online Food Ordering System version 1.0, which stems from an incorrect operation of the parameter userupd that can result in SQL injection...

SUSE CVE-2024-36467

An authenticated user with API access e.g.: user with default User role, more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group e.g.: Zabbix Administrators, except to groups that are disabled or having restricted GUI access...

CVE-2024-36467

An authenticated user with API access e.g.: user with default User role, more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group e.g.: Zabbix Administrators, except to groups that are disabled or having restricted GUI access...

DEBIAN-CVE-2024-36467

An authenticated user with API access e.g.: user with default User role, more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group e.g.: Zabbix Administrators, except to groups that are disabled or having restricted GUI access...

Zabbix 授权问题漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring. Zabbix suffers from an authorization issue vulnerability that stems from the fact that a user with endpoint access to the user.update AP...

CVE-2023-35022

CVE-2023-35022: IBM InfoSphere Information Server 11.7 contains an insecure authorization flaw that could allow a local user to update projects they are not authorized to access. The issue stems from weaknesses in the authorization mechanism, enabling unauthorized project modification (CVE descri...

Lunary Improper Access Control Vulnerability

lunary is lunary open source a production toolkit for LLM . An improper access control vulnerability exists in lunary, which can be exploited by an attacker to update any organization user as the organization owner...

Inquiry Cart <= 3.4.2 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open an HTML file containing: alert9995'...

CVE-2024-27017

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: walk over current view on netlink dump The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure ...

CVE-2024-27017

CVE-2024-27017 relates to the Linux kernel netfilter nft_set_pipapo backend. According to the provided sources, a vulnerability arises because the generation mask can be updated while a netlink dump is in progress, causing the pipapo set backend walk iterator to rely on an inconsistent view of th...

BIT-DISCOURSE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

CVE-2024-25107 Cross-Site Scripting in WikiDiscover

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the Language::date function is used when making the human-readable timestamp for inclusion on the wikicreation column. This function uses interface messages to translate the nam...

Command injection

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings...

PT-2024-13966

Name of the Vulnerable Software and Affected Versions Online Notice Board System version 1.0 Description The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the dd parameter of the "user/update profile.php" resource does not validate the characters received, a...

Novel-Plus Cross-Site Scripting Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A cross-site scripting vulnerability exists in Novel-Plus 4.2.0 and earlier versions, which stems from the parameter nickName in the file /user/updateUserInfo that causes cross-site scripting...

PT-2023-32917 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions up to 4.2.0 Description: A problematic vulnerability has been found in Novel-Plus, affecting an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the nickName...

CVE-2023-47628 Session Expiration Misconfiguration in datahub

DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do not set an expiration time for a cookie. Due to this, if a session cookie were ever leaked, it would be valid forever. DataHub uses a...

Netmaker IDOR Allows User to Update Other User's Password

Impact An IDOR vulnerability was found in the user update function. By specifying another user's username it is possible to update the other user's password. Patches Issue is patched in 0.17.1, and fixed in 0.18.6+. If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1"...