CVE-2024-10215

The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for...

CVE-2024-51714

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in techdabang User Password Reset user-password-reset allows Reflected XSS.This issue affects User Password Reset: from n/a through = 1.0...

CVE-2024-28020

A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through complex routines to extend access on the server and other services...

CVE-2024-37905

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...

CVE-2024-26271

Cross-site request forgery CSRF vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to 1 change us...

CVE-2024-8268

The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajaxrequest function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-45647 IBM Security Verify Access unverified password change

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password...

CVE-2024-45647

IBM Security Verify Access (versions 10.0.0–10.0.8) and IBM Security Verify Access Docker (10.0.0–10.0.8) are affected by CVE-2024-45647, which allows an unauthenticated or unverified user to change the password of an expired user without the password. The underlying issue is CWE-620 (Unverified ...

CVE-2024-50349 Git does not sanitize URLs when asking for credentials interactively

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt i.e. without using any credential helper, it prints out the host name for whic...

CVE-2024-10215 WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change

The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for...

CVE-2024-10215 WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change

The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for...

PT-2025-1579 · WordPress · Wpbookit

Name of the Vulnerable Software and Affected Versions: WPBookit plugin for WordPress versions up to, and including, 1.6.4 Description: The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change. This is due to the plugin providing user-controlled access to objects, letting ...

CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

ABB Cylon Aspect 3.08.02 Cookie User Password Disclosure Vulnerability

ABB Cylon Aspect version 3.08.02 suffers from cleartext transmission and storage of sensitive information in a Cookie. This includes the globals parameter, where authdata contains base64-encoded credentials. A remote attacker can intercept the HTTP Cookie, including authentication credentials,...

The vulnerability of the microprogramming software used in Lexmark’s Embedded Web Server printers allows a perpetrator to gain access to the device.

The vulnerability of Lexmark’s embedded web server printer software relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to gain access to the device by removing the existing privileged user and replacing them with a new password...

Liferay Portal 7.4.3.75 < 7.4.3.112 CSRF

Cross-site request forgery CSRF vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to 1 change us...

The vulnerability of the software journalism process for ABB Platform Engineering Tools and equipment from ABB, such as ABB QCS 800xA and ABB QCS AC450, allows a hacker to obtain the system user’s password.

The vulnerability of the software journalism process for ABB Platform Engineering Tools and ABB QCS 800xA/ABB QCS AC450 devices relates to the disclosure of information through registration files. Exploiting this vulnerability can allow attackers to obtain the password for the system user account...

CVE-2024-52525

CVE-2024-52525 – Nextcloud Server : The vulnerability concerns how the server handles user passwords in memory. Under certain conditions, a user password could be stored unencrypted in the PHP process memory; although session data is encrypted when stored in Redis or disk, a malicious process wit...

Palo Alto Expedition 1.2.91 Remote Code Execution

class MetasploitModule 'Palo Alto Expedition Remote Code Execution CVE-2024-5910 and CVE-2024-9464', 'Description' = %q Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below. The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the...

CVE-2024-51714

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in techdabang User Password Reset user-password-reset allows Reflected XSS.This issue affects User Password Reset: from n/a through = 1.0...