Path traversal

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible...

CVE-2024-27199

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible...

CVE-2024-27199

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible...

CVE-2024-27199

CVE-2024-27199 is a JetBrains TeamCity path traversal vulnerability that could allow limited admin actions on vulnerable TeamCity servers. Affected product: TeamCity server prior to 2023.11.4; underlying issue described as a path traversal/logic flow problem in handling requests. CVSS v3.1 base s...

CVE-2024-27198

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible...

PT-2024-2116

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2023.11.4 Description A path traversal issue exists that allows for the bypass of authentication procedures by using an alternative path or channel. This can enable a remote attacker to perform limited...

CVE-2024-27198

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible Recent assessments: sfewer-r7 at March 04, 2024 8:24pm UTC reported: CVE-2024-27198, allows for a complete compromise of a vulnerable TeamCity server by a remote unauthenticated attacker,...

CVE-2023-49543

Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating...

CVE-2023-49543

Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating...

DRUPAL-CONTRIB-2024-014

The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions. This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations...

Fortinet FortiClient EMS 安全漏洞

Fortinet FortiClientEMS is part of Fortinet's Endpoint Management solution from Fortinet, a U.S.-based company, and is designed to help organizations effectively manage endpoint devices in their networks and provide monitoring and control of endpoint security. An improper privilege management...

Debug < 1.11 - CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins perform unwanted actions, such as clear logs, via CSRF attacks...

PT-2024-19720 · WordPress · Recover Woocommerce Cart Abandonment

Name of the Vulnerable Software and Affected Versions: WooCommerce Cart Abandonment Recovery WordPress plugin versions prior to 1.2.27 Description: The issue concerns a lack of CSRF check in bulk actions, which could allow attackers to make logged-in admins delete arbitrary email templates as wel...

Code injection

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

PT-2023-31441 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Fees Management System version 1.0 Description: The issue allows attackers to escalate privileges and perform administrative actions, including adding and deleting user accounts, due to broken access control in the...

CVE-2023-47573

An issue discovered in Relyum RELY-PCIe 22.2.1 devices. The authorization mechanism is not enforced in the web interface, allowing a low-privileged user to execute administrative functions...

PT-2023-32353 · WordPress · Thumbnail Slider With Lightbox

Name of the Vulnerable Software and Affected Versions: The Thumbnail Slider With Lightbox plugin for WordPress version 1.0 Description: The issue is due to missing or incorrect nonce validation on the addedit functionality. This allows unauthenticated attackers to upload arbitrary files via a...

PT-2023-31216 · WordPress · Bear

Name of the Vulnerable Software and Affected Versions: The BEAR for WordPress versions up to, and including, 1.1.3.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the woobe bulkoperations visibility function. This allows...

CVE-2023-4659

Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an...

CVE-2023-4659 Cross-Site Request Forgery in Free5Gc

Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an...