7240 matches found
auth-js 路径遍历漏洞
auth-js is a Supabase Auth isomorphic Javascript library open-sourced by Supabase. A path traversal vulnerability exists in versions of auth-js prior to 2.69.1, which stems from an unvalidated user-supplied UUID and could lead to URL path traversal...
PT-2025-23011 · Auth-Js · Auth-Js
Name of the Vulnerable Software and Affected Versions: auth-js versions prior to 2.69.1 Description: The issue concerns the auth-js library, an isomorphic Javascript library for Supabase Auth. Prior to version 2.69.1, certain library functions such as getUserById, deleteUser, updateUserById,...
CVE-2024-52528
Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2...
CVE-2024-29036
Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users shoul...
CVE-2024-12059
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the elioptionvalue shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...
CVE-2024-33516
An unauthenticated Denial of Service DoS vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the controller...
CVE-2023-28131
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to th...
CVE-2023-47229
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vyas Dipen Top 25 Social Icons plugin = 3.1 versions...
CVE-2023-23681
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin = 4.0 versions...
CVE-2023-32600
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Rank Math SEO plugin = 1.0.119 versions...
CVE-2023-27435
Cross-Site Request Forgery CSRF vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin = 0.3.2 versions...
CVE-2023-27619
Auth subscriber+ Reflected Cross-Site Scripting XSS vulnerability in Macho Themes Regina Lite theme = 2.0.7 versions...
CVE-2023-23728
Auth. contributor+ Cross-Site Scripting XSS vulnerability in Winwar Media WP Flipclock plugin = 1.7.4 versions...
CVE-2023-22712
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TemplatesNext TemplatesNext ToolKit plugin = 3.2.7 versions...
CVE-2023-22698
Auth. contributor+ Cross-Site Scripting XSS vulnerability in Jason Bobich Theme Blvd Responsive Google Maps plugin = 1.0.2 versions...
CVE-2023-39988
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in 标准云std.Cloud WxSync plugin = 2.7.23 versions...
CVE-2023-41945
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted...
CVE-2023-38922
Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the httppasswd and httpusername parameters in the updateauth function...