CVE-2024-10696

The UltraAddons – Elementor Addons Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.8 via the showtemplate due to missing validatio...

CVE-2024-10524 GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host...

SUSE CVE-2024-50268

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsiccgupdatesetnewcamcmd The "cmd" variable can be controlled by the user via debugfs. That means "newcam" can be as high as 255 while the size of the uc-updated array is UCSIMAXALTMODE...

CVE-2024-52511 Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables

Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0...

CVE-2024-52511 Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables

Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0...

Authorization Bypass Through User-Controlled Key in Tables

None...

The vulnerability of Siemens Industrial Edge Management’s centralized control platform for industrial peripheral applications and devices lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the centralized control platform for industrial peripheral applications and Siemens Industrial Edge Management IEM devices relates to the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to circumvent security...

CVE-2023-47543

An authorization bypass through user-controlled key vulnerability CWE-639 in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacker to interact with ressources of other organizations via HTTP or HTTPS requests...

python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service

A flaw was found in Python's zipfile module. When iterating over the entries of a zip archive, the process can enter into an infinite loop state and become unresponsive. This flaw allows an attacker to craft a malicious ZIP archive, leading to a denial of service from the application consuming th...

python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service

A flaw was found in Python's zipfile module. When iterating over the entries of a zip archive, the process can enter into an infinite loop state and become unresponsive. This flaw allows an attacker to craft a malicious ZIP archive, leading to a denial of service from the application consuming th...

SQL Injection

langchain-ai/langchain is vulnerable to SQL injection. The vulnerability is due to insufficient input validation in the GraphCypherQAChain class, which allows user-controlled inputs to be embedded in SQL queries without proper sanitization...

PT-2024-35650

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential array underflow issue has been identified in the Linux kernel, specifically in the ucsi ccg sync control function. The command variable can be controlled by the user via...

GHSA-Q78V-CV36-8FXJ Devtron has SQL Injection in CreateUser API

Summary An authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. Details The API is CreateUser /orchestrator/user. The function to read user input is:...

CVE-2024-49773

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. currentpost parameter in export entry point can be abused ...

CVE-2024-49773 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. currentpost parameter in export entry point can be abused ...

CVE-2024-49773

SuiteCRM vulnerability CVE-2024-49773 involves poor input validation in the export functionality, where the authenticated user can abuse the current_post parameter to perform blind SQL injection via generateSearchWhere(), leading to potential information disclosure of personally identifiable info...

CVE-2024-49773 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. currentpost parameter in export entry point can be abused ...

CVE-2024-37277

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4...

CVE-2024-37277

CVE-2024-37277 is an Authorization Bypass via a user-controlled key affecting Paid Memberships Pro

PT-2024-27440 · Unknown · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro versions n/a through 3.0.4 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: Fo...