319 matches found
Ski & bike helmets protect your head, not location or voice
TL;DR Livall smart ski and bike helmet app leaks the wearers real time position Group audio chat allows snooping on conversations Both issues are due to missing authorisation Bike app affects 1 million users, ski app affects a few thousand users Fixed by the vendor, but after we had to call on a...
12 Step Meeting List < 3.14.29 - Subscriber+ CSV Download
Description The plugin does not have authorisation in its csv AJAX action, allowing any authenticated users, such a subscriber to export meetings and gain access to sensitive information...
CVE-2023-6384
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
CVE-2023-6384 WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...
CVE-2023-6384
CVE-2023-6384 affects the WP User Profile Avatar WordPress plugin, vulnerable in versions before 1.0.1. The issue is an authorization/IDOR flaw that lets authors delete or update arbitrary avatars due to improper access checks. Impact is limited to avatar management (not full site compromise) as ...
Exploit for Improper Input Validation in Kubernetes Ingress-Nginx
CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is...
CVE-2024-0238
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata...
CVE-2022-0775
The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment...
WooCommerce Canada Post Shipping < 2.8.4 - Unauthenticated Unauthorised Action
Description The plugin does not have authorisation check in an action, which could allow unauthenticated users to perform an unauthorised action...
Essential Blocks for Gutenberg < 4.2.1 - Contributor+ Unauthorised Actions
Description The plugin does not have proper authorisation checks in various functions, allowing contributor and above role to perform unauthorized actions...
Product Expiry for WooCommerce < 2.6 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
Integrate Google Drive < 1.3.4 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
GTG Product Feed for Shopping <= 1.2.4 - Unauthenticated Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow unauthenticated users to update them...
CVE-2023-5611
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them...
Welcome Email Editor < 5.0.7 - Subscriber+ Email Sending
Description The plugin does not have authorisation in its ajaxhandler function, allowing any authenticated users, such as subscriber to call it and send various emails...
WP Travel < 7.8.1 - Unauthenticated AJAX Calls
Description The plugin does not have authorisation checks in various AJAX actions, allowing unauthenticated users to call them and update the plugin settings for example...
Ashe Extra <= 1.2.9 - Subscriber+ Companion Plugin Activation & Content Import
Description The plugin does not have authorisation in various AJAX actions, allowing any authenticated user, such as subscribers to call them, and activate companion plugins as well as import content...
FeedFocal <= 1.2.2 - Unauthenticated Tracking Code Update
Description The plugin is lacking authorisation checks in its feedfocalapisetup function, allowing unauthenticated attackers to update the Tracking Code via the feedfocalsurveycode option...
USN-6492-1 mosquitto vulnerabilities
Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2021-34431...