CVE-2024-23576

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

PT-2024-19944 · Hcl · Hcl Commerce

Name of the Vulnerable Software and Affected Versions: HCL Commerce versions 9.1.12 through 9.1.13 Description: The issue allows for denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. Recommendations: For versions 9.1.12 and 9.1.13, at t...

CVE-2024-3478

The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks...

CVE-2024-3475

The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3476

The CVE-2024-3476 entry concerns the WordPress plugin Side Menu Lite (versions prior to 4.2.1). A CSRF flaw in certain bulk actions could allow an attacker to cause logged-in admins to perform unintended actions (e.g., deleting items). Root cause: lack of CSRF checks on bulk actions. Impact is de...

PT-2024-26178 · WordPress · Popup Box

Name of the Vulnerable Software and Affected Versions: The Popup Box WordPress plugin versions prior to 2.2.7 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting popups v...

CVE-2024-25572

Cross-site request forgery CSRF vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed...

Sticky Buttons < 3.2.4 - Button Deletion via CSRF

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks PoC Make a logged in admin open an HTML file where ID is a valid ID: action...

PT-2024-21013 · Unknown · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms versions prior to 3.4.31 Description: A cross-site request forgery CSRF issue exists, allowing unintended operations to be performed if a website administrator views a malicious page while logged in. Recommendations: For versions...

CVE-2023-49978

Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators...

CVE-2023-49982

Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

CVE-2024-27198 - JetBrains TeamCity Authentication Bypass Jet...

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions...

VulnCheck KEV: CVE-2024-27198

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions...

TeamCity Server < 2023.11.4 Multiple Vulnerabilities

According to its its self-reported version number, the version of JetBrains TeamCity running on the remote host is a version prior to 2023.11.4. It is, therefore, affected by multiple vulnerabilities: - Authentication bypass allowing to perform admin actions was possible. CVE-2024-27198 - Path...

CVE-2024-27199

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible...

CVE-2024-27199

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible...

CVE-2024-27199

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible Rapid7 Analysis Overview CVE-2024-27199 is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue CWE-22 and has a CVSS base score ...

CVE-2024-27198

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible...

Authentication flaw

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible...