CVE-2023-6523 IDOR in ExtremePacs's Extreme XDS

Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse. This issue affects Extreme XDS: before 3914...

Visual Planning REST API 2.0 Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Title ===== SCHUTZWERK-SA-2023-003: Authentication Bypass in Visual Planning REST API Status ====== PUBLISHED Version ======= 1.0 CVE reference ============= CVE-2023-49231 Link ==== https://www.schutzwerk.com/advisories/schutzwerk-sa-2023-003/...

PT-2024-14991 · Extreme Networks · Extreme Xds

Name of the Vulnerable Software and Affected Versions: Extreme XDS versions prior to 3914 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS, allowing Authentication Abuse. Recommendations: For versions prior to 3914,...

The vulnerability of the FortiOS operating system, related to bypassing authentication by using a user-controlled key, allows a perpetrator to gain unauthorized access to confidential information.

The vulnerability of the FortiOS operating system relates to bypassing authentication by using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential information...

CVE-2024-31095

Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0...

CVE-2024-30543

Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18...

CVE-2024-30543

CVE-2024-30543 is an authorization bypass via a user-controlled key in the UPQODE Whizz/Whizzy WordPress plugin, affecting versions from n/a to 1.1.18. The CVSS 3.1 base score is 6.5 (Network attack, Low attack complexity, Privileges Required: None, User Interaction: None, Confidentiality/Integri...

CVE-2024-31095 WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

A vulnerability in Ricard Torres Thumbs Rating thumbs-rating.This issue affects Thumbs Rating: from n/a through = 5.1.0...

CVE-2024-31095 WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0...

PT-2024-23763 · Unknown · Thumbs Rating

Name of the Vulnerable Software and Affected Versions: Thumbs Rating versions 5.1.0 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects the Thumbs Rating software. Recommendations: For Thumbs Rating version...

CVE-2024-30513

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2...

CVE-2024-30513

CVE-2024-30513 weakly documented in the provided sources is described as an Authorization Bypass Through User-Controlled Key in ProfileGrid (Metagauss ProfileGrid), affecting ProfileGrid versions up to 5.7.2. Connected documents corroborate the authorisation bypass context and link to PatchStack ...

CVE-2024-30507 WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7...

PT-2024-23434 · Molongui · Molongui

Name of the Vulnerable Software and Affected Versions: Molongui versions through 4.7.7 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects Molongui, allowing for potential unauthorized access. Recommendations: For...

PT-2024-23441 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.7.2 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid. Recommendations: For versions through 5.7.2, update to a version lat...

Authorization Bypass

@oneuptime/common-server and @oneuptime/model are vulnerable to Authorization Bypass Through User-Controlled Key. The vulnerability is due to improper validation of the ismasteradmin key stored in the browser local storage. Attackers can manipulate this key from false to true, granting themselves...

Authorization Bypass

Grafana vulnerable to Authorization Bypass Through User-Controlled Key. The vulnerability is due to insufficient validation of organization IDs in the DeleteDashboardSnapshot within dashboardsnapshot.go. This allows an attacker to bypass authorization and delete a snapshot by sending a DELETE...

CVE-2024-28233

JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API...

CVE-2024-28233 XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing

JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API...

CVE-2024-28233 XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing

JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API...