CVE-2024-48953

An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization checks. This allowed unauthenticated users to register their own authentication plugins in Logpoint, resulting in unauthorized access...

CVE-2024-48953

An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization checks. This allowed unauthenticated users to register their own authentication plugins in Logpoint, resulting in unauthorized access...

CVE-2024-48953

Logpoint versions prior to 7.5.0 are vulnerable to a security issue caused by missing authorization checks on specific endpoints. Specifically, the endpoints used for creating, editing, or deleting third-party authentication modules do not properly validate user permissions. This flaw allows unau...

RHEL 9 : postgresql:16 (RHSA-2024:5929)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5929 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL pgstatsext and...

RHEL 8 : postgresql:16 (RHSA-2024:5927)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5927 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL pgstatsext and...

CVE-2024-10008

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes ...

CVE-2024-10008 Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes ...

CVE-2024-9627

The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'serviceprocess' function in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to view the Telegram Bot...

CVE-2024-9627

CVE-2024-9627 concerns the WordPress plugin “TeploBot – Telegram Bot for WP.” The vulnerability is a missing authorization check in the service_process function across all versions up to and including 1.3, allowing unauthenticated attackers to disclose the Telegram Bot Token (secret for bot contr...

CVE-2024-9627 TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure

The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'serviceprocess' function in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to view the Telegram Bot...

CVE-2024-9627 TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure

The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'serviceprocess' function in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to view the Telegram Bot...

CVE-2022-4974 Freemius SDK <= 2.4.2 - Missing Authorization Checks

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the getdebuglog, getdboption, and the setdboption functions in versions up to, and...

KubeSphere IDOR vulnerability

An Insecure Direct Object Reference IDOR vulnerability in KubeSphere v3.4.1 and v4.1.1 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks...

CVE-2024-46528

An Insecure Direct Object Reference IDOR vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks...

CVE-2024-46528

KubeSphere is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2024-46528) due to missing authorization checks. This flaw allows low-privileged authenticated attackers to access sensitive resources, such as cluster information, node information, and registered users, wi...

CVE-2024-46528

An Insecure Direct Object Reference IDOR vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks...

CVE-2024-9821 Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stmwpcftogetsettings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with...

CVE-2024-9821

CVE-2024-9821 : The WordPress plugin “Bot for Telegram on WooCommerce” is vulnerable to sensitive information disclosure due to missing authorization checks on the stm_wpcfto_get_settings AJAX action, affecting all versions up to 1.2.4. Authenticated attackers with subscriber-level access and abo...

PT-2024-39866 · WordPress · The Bot For Telegram On Woocommerce

Name of the Vulnerable Software and Affected Versions: The Bot for Telegram on WooCommerce plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to sensitive information disclosure due to missing authorization checks on the 'stm wpcfto get settings' AJAX...

[SECURITY] [DSA 5785-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5785-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2024 https://www.debian.org/security/faq -...