CVE-2024-3229 Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLNActionAjaxImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated...

Low: postgresql15

Issue Overview: postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Affected Packages: postgresql15 Issue Correction: Run dnf update postgresql15 --releasever 2023.4.20240611 to update your system. New Packages: aarch64: ...

WordPress plugin Download Manager security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability previously existed...

WordPress plugin InstaWP Connect security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin Highcompress Image Compressor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

Low: postgresql

Issue Overview: postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Affected Packages: postgresql Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section...

CVE-2024-37176

SAP BW/4HANA Transformation and Data Transfer Process DTP allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low...

CVE-2024-34691

Manage Incoming Payment Files F1680 of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system...

CVE-2024-34691 Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)

Manage Incoming Payment Files F1680 of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system...

CVE-2024-37176

CVE-2024-37176 concerns SAP BW/4HANA Transformation and Data Transfer Process (DTP). The connected sources describe an authentication-required path where improper authorization checks allow an attacker to elevate privileges within the SAP BW/4HANA DTP, with no impact to data confidentiality and l...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-011)

The version of postgresql installed on the remote host is prior to 14.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-011 advisory. postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Tenable has extracted t...

SAP S/4HANA Security Vulnerabilities

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. A security vulnerability exists in SAP S/4HANA that stems from a failure to perform the required authorization checks for authenticated users, which could result in privile...

SAP BW/4HANA Security Vulnerabilities

SAP BW/4HANA is a packaged data warehouse based on SAP HANA from SAP, Germany. A security vulnerability exists in SAP BW/4HANA that stems from allowing authenticated attackers to gain a higher level of access than they deserve by exploiting improper authorization checks, which can lead to privile...

CVE-2024-5129

A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion...

CVE-2024-5129

A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion...

CVE-2024-5129

The CVE-2024-5129 entry concerns lunary-ai/lunary version 1.2.2 where the datasets.delete function lacks authorization checks. This allows an unauthenticated user to delete any dataset by issuing a DELETE request with the dataset ID, constituting a privilege-escalation/unauthorized data deletion ...

CVE-2024-5129 Privilege Escalation Vulnerability in lunary-ai/lunary

A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion...

CVE-2024-5129 Privilege Escalation Vulnerability in lunary-ai/lunary

A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion...

Lunary 安全漏洞

lunary is lunary open source a production toolkit for LLM . An elevation of privilege vulnerability exists in lunary that stems from a lack of authorization checking and can be exploited by an attacker to delete any dataset...

PT-2024-34586 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.2 Description: A Privilege Escalation issue exists due to missing authorization checks, allowing any user to delete datasets. The issue is present in the dataset deletion functionality, where the application fails...