6462 matches found
CVE-2024-1639
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey and showAllLicenseKeys functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with admi...
PT-2024-30673 · WordPress · Cb
Name of the Vulnerable Software and Affected Versions: CB legacy WordPress plugin versions 0.9.4.18 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example i...
Credential Leakage
org.keycloak, keycloak-core is vulnerable to Credential Leakage. The vulnerability is due to a lack of proper validation and enforcement when administrators change the LDAP Connection URL without requiring re-entry of the currently configured LDAP bind credentials. The vulnerability allows an...
GHSA-GMRM-8FX4-66X7 Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c25h-c27q-5qpv. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently...
Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c25h-c27q-5qpv. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently...
CVE-2024-5967
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access permission manage-realm to change the LDAP host URL "Connection URL"...
CVE-2024-5967
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access permission manage-realm to change the LDAP host URL "Connection URL"...
CVE-2024-5967
CVE-2024-5967 affects Red Hat’s Keycloak/SO deployments (e.g., Red Hat Single Sign-On 7.6.x and 22.0.x). The admin console allows changing the LDAP Connection URL without re-entering credentials, enabling an admin with manage-realm to redirect LDAP host to an attacker-controlled server and leak t...
PT-2024-37278 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw in the LDAP testing endpoint allows an attacker with admin access to change the LDAP host URL to a machine they control, potentially leaking domain credentials. This can be achieved...
PT-2024-9958 · Ca · Ca Client Automation
Name of the Vulnerable Software and Affected Versions: CA Client Automation ITCM affected versions not specified Description: The issue is related to insecure privilege management in the CA Client Automation software, which allows non-admin or non-root users to encrypt strings using the CAF CLI a...
CVE-2024-2218
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-31161
The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system...
CVE-2024-27180
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL...
CVE-2024-27180 TOCTOU vulnerability
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL...
CVE-2024-27180 TOCTOU vulnerability
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL...
WordPress plugin Alemha watermarker security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...
PT-2024-28767 · WordPress · Social Pixel
Name of the Vulnerable Software and Affected Versions: The Social Pixel WordPress plugin versions through 2.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in...
PT-2024-21715 · Toshiba Tec · Toshiba Tec E-Studio Multi-Function Peripheral +44
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An attacker with admin access can install rogue applications. There is no information provided about the estimated number of potentially affected device...
PT-2024-25958 · Terramaster · Terramaster Tos
Name of the Vulnerable Software and Affected Versions: TerraMaster TOS firmware versions through 5.1 Description: The issue concerns hardcoded credentials in the firmware, allowing a remote attacker to login to the mail or webmail server. These credentials can also be used to access the...