The vulnerability of Acronis Cyber Protect 16’s data protection software lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to increase their privileges.

The vulnerability of Acronis Cyber Protect 16 data protection software lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

PT-2024-10218 · Schneider Electric · Schneider Electric Powerlogic Hdpm6000

Name of the Vulnerable Software and Affected Versions: Schneider Electric PowerLogic HDPM6000 version 0.62.7 Description: The issue is related to an authorization bypass vulnerability that could allow an authorized attacker to modify values outside those defined by their privileges, potentially...

CVE-2024-50483

Authorization Bypass Through User-Controlled Key vulnerability in Meetup allows Privilege Escalation.This issue affects Meetup: from n/a through 0.1...

CVE-2024-50483

Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a through = 0.1...

PT-2024-38766 · Dsy · 3Dswym

Name of the Vulnerable Software and Affected Versions: 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x Description: The issue is an authorization bypass through a user-controlled key vulnerability. This allows an authenticated attacker to access some unauthorized data. The vulnerability is...

CVE-2024-9687 WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-9687 WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-47495

An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines REs are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolv...

CVE-2024-47495

An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines REs are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolv...

CVE-2024-47495 Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device.

An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines REs are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolv...

Juniper Junos OS Vulnerability (JSA88122)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88122 advisory. - An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual...

CVE-2024-47316

Authorization Bypass Through User-Controlled Key vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.9...

CVE-2024-47316 WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.9...

CVE-2024-47316

CVE-2024-47316 affects the WordPress Salon Booking System plugin (versions

PT-2024-32528 · Unknown · Salon Booking System

Name of the Vulnerable Software and Affected Versions: Salon Booking System versions through 10.9 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects the Salon Booking System, allowing for potential unauthorized access...

The vulnerability of the Next.js software platform for creating web applications lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a non-dynamic cache from the server...

The vulnerability of the Group Member Handler component in the Git-based software platform, which is used for collaborative code development on GitLab, allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Group Member Handler component in the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

Authorization Bypass Through User-Controlled Key

Overview aimeos/ai-controller-frontend is an Aimeos business controller logic for frontend Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the account profile page. An attacker can manipulate account details and disable subscriptions an...

CVE-2024-8290

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFMCustomersManageController::processing function due to missing validation...

CVE-2024-7491 HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woofmessengerremovesubscr AJAX action due to missing validation on the 'key' user controlled key. This makes it...