CVE-2024-22513

The djangorestframework-simplejwt library (versions 5.3.1 and before ) is vulnerable to information disclosure due to missing user validation checks in the for_user method. This allows a user to access web application resources even after their account has been disabled . Exploiting this can lead...

CVE-2024-22513

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the foruser method...

CVE-2024-22513

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the foruser method...

Input validation

The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitformsupdateformentry AJAX action in all versions up to, and...

CVE-2024-1640

CVE-2024-1640 pertains to the WordPress plugin “Contact Form Builder by Bit Form” (Bit Form). The issue is insufficient user validation in the bitforms_update_form_entry AJAX action across all versions up to 2.10.1, enabling unauthenticated attackers to modify form submissions. The Red Hat adviso...

CVE-2024-20346

A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perform a reflected cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of...

FlyCms Cross-Site Request Forgery Vulnerability (CNVD-2024-12210)

FlyCms is an application. A similar to Zhihu to Q&A based on the completely open source JAVA language development of social network building program. A cross-site request forgery vulnerability exists in FlyCms v1.0, which stems from /system/share/ztreecategoryedit does not adequately validate...

CVE-2024-25625

Pimcore Admin UI Classic Bundle (prior to 1.3.4) is vulnerable to Host Header Injection via the invitationLinkAction in UserController. The login URL is built using unvalidated host headers when generating $loginUrl, allowing an attacker to inject a malicious domain into invitation emails and ena...

GHSA-6H78-85V2-MMCH PHPMailer Shell command injection

PHPMailer before 1.7.4, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php. Impact Shell command injection, remotely exploitable if host application does not filter user data...

CVE-2023-6824 WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6223 LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure

The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers,...

IBM Sterling B2B Integrator 安全漏洞

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. IBM Sterling B2B Integrator suffe...

What Is Zero Trust Network Access (ZTNA) ?

Unraveling the Mysteries Behind the Zero Trust Network Access ZTNA Paradigm Digital protection strategies have traditionally relied heavily on the concept of trust. However, these conventional notions, which assume a considerable measure of security within an organization's connectivity sphere,...

IceCMS 跨站请求伪造漏洞

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . A cross-site request forgery vulnerability exists in IceCMS v2.0.1, which originates from a WEB application that does not adequately validate whether a request comes from a trusted user. An attack...

Input validation

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

CVE-2023-20179

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

CVE-2023-4613

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation...

CVE-2023-38890

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...

CVE-2023-40165 Unauthorized gem replacement for full names ending in numbers on rubygems.org

rubygems.org is the Ruby community's primary gem library hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching /-\d/, permanently replacing the legitimate upload in the canonical gem...

CVE-2023-37068

Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username and password field...