IBM Sterling Partner Engagement Manager Authentication Error Vulnerability

IBM Sterling Partner Engagement Manager is an automated management tool from International Business Machines IBM. An authentication error vulnerability exists in IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2.0, and 6.2.2, which stems from the program improperly authenticating a remo...

Lack of access control on overrideSanction(), any user can override sanctioned address

Lines of code Vulnerability details Impact Without proper access control, any address can call the overrideSanction function and override the sanction status of an account. This can potentially be exploited by malicious actors to bypass sanctions and carry out unauthorized actions, putting the...

CVE-2023-43508

Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to...

Authorization

Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities allow an attacker to...

Product Category Tree <= 2.5 - CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Unauthorized Ownership Transfer and Asset Withdrawal Vulnerability in quitSystem Function

Lines of code Vulnerability details Impact The quitSystem function in the contract is vulnerable to unauthorized asset control. This vulnerability arises when an allowed user, rather than the owner, exploits their permissions to perform unauthorized actions. Specifically, the allowed user can...

Auto Login New User After Registration <= 1.9.6 - CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Open Graph Metabox <= 1.4.4 - CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2023-43508

Technical details (affected product versions, root cause, and fixes) are not publicly disclosed in the provided documents; monitor for updates from Aruba and related advisories.

PT-2023-29679 · WordPress · Gopi Ramasamy Scroll Post Excerpt Plugin

Name of the Vulnerable Software and Affected Versions: Gopi Ramasamy Scroll post excerpt plugin versions = 8.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This type of vulnerability allows an attacker to inject...

PT-2023-29683 · Fastwpspeed · Fast Wp Speed

Name of the Vulnerable Software and Affected Versions: Fastwpspeed Fast WP Speed plugin version 1.0.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into websites, potentially leading to unauthoriz...

PT-2023-28851 · Aruba Networks · Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba Networks ClearPass Policy Manager affected versions not specified Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change...

CVE-2023-43045

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896...

CVE-2023-43045

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896...

Authentication flaw

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896...

CVE-2023-43045 IBM Sterling Partner Engagement Manager security bypass

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896...

IBM Sterling Partner Engagement Manager 访问控制错误漏洞

IBM Sterling Partner Engagement Manager is an automated management tool from International Business Machines IBM. An authentication error vulnerability exists in IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2.0, and 6.2.2, which stems from the program improperly authenticating a remo...

CVE-2023-5534

The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions vi...

CVE-2023-5533

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions tha...

CVE-2023-5602

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for...