CVE-2023-34218

In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible...

CVE-2023-34218

In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible...

CVE-2023-34218

Summary: CVE-2023-34218 affects JetBrains TeamCity prior to 2023.05. The issue is a bypass of permission checks that enables performing admin actions. The vulnerability is documented with high-severity scores (CVSS base metrics indicate critical impact on confidentiality, integrity, and availabil...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A security vulnerability exists in JetBrains TeamCity...

PT-2023-24743 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05 Description: The issue allows bypass of permission checks, enabling the performance of admin actions. Recommendations: For versions prior to 2023.05, update to version 2023.05 or later to resolve t...

PT-2023-16744 · WordPress · Coupon Zen

Name of the Vulnerable Software and Affected Versions: Coupon Zen WordPress plugin versions prior to 1.0.6 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

Osprey Pump Controller 跨站请求伪造漏洞

Osprey Pump Controller is a pump controller from Osprey. A security vulnerability exists in Osprey Pump Controller version 1.01. An unauthorized attacker could exploit this vulnerability to perform operations with administrative privileges...

CVE-2022-38375

An improper authorization vulnerability CWE-285 in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...

SUSE CVE-2008-5621

Cross-site request forgery CSRF vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tblstructure.php with a modified table parameter. NOTE: other unspecified pages are also...

PT-2023-1510 · Fortinet · Fortinac

Name of the Vulnerable Software and Affected Versions: Fortinet FortiNAC versions 9.4.0 through 9.4.1 Fortinet FortiNAC versions prior to 9.2.6 Description: The issue is related to improper authorization, allowing an unauthenticated user to perform administrative operations via crafted HTTP POST...

PT-2023-15326 · WordPress · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area versions prior to 8.1.4 Description: The issue concerns a lack of CSRF checks for certain actions, such as chmod, mkdir, and copy. This could allow attackers to make a logged-in admin perform these actions, resulting in the...

CVE-2023-0715

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxclonefolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke thi...

Authorization

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxsavestate function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

Cross site request forgery (csrf)

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxsavestate function. This makes it possible for unauthenticated attackers to invoke this function via forge...

CVE-2023-0727

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxdeletefolder function. This makes it possible for unauthenticated attackers to invoke this function via...

VulnCheck KEV: CVE-2020-20627

The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change...

CVE-2022-4426

The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack...

CVE-2022-4016

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins...

PT-2022-21775 · WordPress · Event Monster

Name of the Vulnerable Software and Affected Versions: Event Monster WordPress plugin versions prior to 1.2.0 Description: The issue concerns a lack of CSRF check when deleting visitors, which could allow attackers to make logged-in admins delete arbitrary visitors via a CSRF attack...

CVE-2022-38329

A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to perform unintended actions on an affected system. The vulnerability could allow attackers to modify or delete specific content through...