8033 matches found
Flaw in Right-Wing ‘Election Integrity’ App Exposes Voter-Suppression Plan and User Data
A bug that WIRED discovered in True the Vote’s VoteAlert app revealed user information—and an election worker who wrote about carrying out an illegal voter-suppression scheme...
The vulnerability of the software’s user data loading function for running large language models (LLMs) like ChuanhuChatGPT allows a perpetrator to execute arbitrary code.
The vulnerability of the software’s user data loading function for running large language models like ChuanhuChatGPT is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
Access control vulnerable to user data deletion by anonynmous users
Impact Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. Patches The problem is fixed in version 7.2. Workarounds The problem can be fixed by adding dataroles = to AccessControl.userfolder.UserFolder. References...
CVE-2024-51734
CVE-2024-51734 affects Zope AccessControl prior to version 7.2, where anonymous users can delete data in AccessControl.userfolder.UserFolder, potentially disrupting privileged access. The issue is fixed in 7.2; a workaround is to set data__roles__ = () on the UserFolder. No exploitation details a...
CVE-2024-51734 User data deletion by anoynmous users in Zope
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...
MSC-2024-15751
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
Zope AccessControl 访问控制错误漏洞
Zope AccessControl is the common security framework used in Zope from the Zope Foundation. An access control error vulnerability exists in Zope AccessControl versions prior to 7.2, which stems from an attacker being able to delete user data maintained by AccessControl.userfolder.UserFolder, which...
PT-2024-34872
Name of the Vulnerable Software and Affected Versions Zope AccessControl versions prior to 7.2 Description The issue allows anonymous users to delete the user data maintained by an AccessControl.userfolder.UserFolder, which may prevent any privileged access. Recommendations For versions prior to...
Access control vulnerable to user data deletion by anonynmous users
Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access...
MSC-2024-15671
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
CVE-2024-49770 oak's path traversal allows transfer of hidden files within the served root directory
oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default oak does not allow transferring of hidden files with Context.send API. However, prior to version 17.1.3, this can be bypassed by encoding / as its URL encoded...
oak 安全漏洞
oak is a middleware framework from oak open source. A security vulnerability exists in oak versions prior to 17.1.3. An attacker exploiting the vulnerability can read sensitive user data or gain access to server secrets...
CVE-2024-10399
CVE-2024-10399 affects the WordPress plugin Download Monitor (versions ≤ 5.0.13). The issue is a missing capability check in ajax_search_users, allowing authenticated attackers with Subscriber+ privileges to perform unauthorized data modifications and to obtain site usernames and emails. The vuln...
CVE-2024-7474 IDOR in lunary-ai/lunary
In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference IDOR vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access...
CVE-2024-7474
In lunary-ai/lunary v1.3.2, CVE-2024-7474 describes an Insecure Direct Object Reference (IDOR) vulnerability where an attacker can view or delete external users by tampering with the id parameter in the request URL. The issue stems from inadequate checks on id, enabling unauthorized access to ext...
WordPress plugin Masteriyo LMS 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...
Lunary 访问控制错误漏洞
lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from not properly restricting permissions to update the SAML configuration. An attacker could use this vulnerability to modify the authentication process and steal user...
CVE-2024-44216
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to access user-sensitive data...
