PT-2022-13188 · WordPress · Xcloner Plugin

Name of the Vulnerable Software and Affected Versions: Backup, Restore and Migrate WordPress Sites With the XCloner Plugin versions prior to 4.3.6 Description: The issue concerns a lack of authorization and CSRF checks when resetting settings in the plugin, allowing unauthenticated attackers to...

WordPress plugin ARMember 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress ARMember plugin versions prior to 3.4.8 have a security vulnerability that stems from the plugin's...

CVE-2022-31595

SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2022-31595

SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2022-31595

SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

Authorization

SAP Financial Consolidation - version 1010,?does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2022-31595

Affected product: SAP Financial Consolidation version 1010. The issue arises from missing authorization checks for an authenticated user, enabling escalation of privileges. This vulnerability is documented across multiple sources (SAP notes and CVE entries) with high-severity impact in CVSS 3.1/3...

PT-2022-20864 · Sap · Sap Financial Consolidation

Name of the Vulnerable Software and Affected Versions: SAP Financial Consolidation version 1010 Description: The issue results in escalation of privileges due to the lack of necessary authorization checks for an authenticated user. Recommendations: For SAP Financial Consolidation version 1010,...

SAP Financial Consolidation 安全漏洞

SAP Financial Consolidation is a financial statement solution from SAP. The product is designed to automate intercompany reconciliations and offsets, currency conversions, and provide financial statement generation. A security vulnerability exists in SAP Financial Consolidation version 1010, whic...

Authorization

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments...

CVE-2022-0885 Member Hero <= 1.0.9 - Unauthenticated RCE

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments...

CVE-2022-0885

Affected software/variant : WordPress Member Hero plugin versions 1.0.0–1.0.9. Vulnerability : unauthenticated remote code execution via an AJAX parameter; plugin lacks authorization checks and does not validate the parameter, enabling calls to arbitrary PHP functions with no arguments. Impact : ...

Powertek PDU Certification Bypass Vulnerability

Powertek, a company that manufactures data center-grade intelligent PDUs power distribution units, or heavy-duty power cords for server racks, has an authentication bypass vulnerability that can be exploited by an attacker to bypass active session authorization checks. It can then be used to gain...

LinkedIn: Campaign Account Balance and History Disclosed in API Response

During the security assessment of the application, it has been observed that server-side authorization checks are not implemented on the 'GET /campaign-manager-api/campaignManagerAccounts/:campaignId/accountCredits?q=account' HTTP request. As a result, an attacker can fetch the campaign wallet...

Security Bulletin: IBM MQ can be incorrectly configured to prevent required authorization checks (CVE-2022-22316)

Summary An issue was identified within the IBM MQ queue manager logic that meant improper authorization checks were performed when incorrect settings were configured for IBM MQ Clustering. Vulnerability Details CVEID: CVE-2022-22316 DESCRIPTION: IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an...

Member Hero <= 1.0.9 - Unauthenticated RCE

The plugin lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments. PoC curl https://example.com/wp-admin/admin-ajax.php?action=memberherosendform&memberherohook=phpinfo...

CVE-2022-29611

SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

PT-2022-19724 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform affected versions not specified Description: The issue is related to the lack of necessary authorization checks for an authenticated user, resulting in escalation of privileges. This...

SAP NetWeaver Application Server 安全漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server, which results in an escalation of privileges due to a failure to perform the required authorization checks for authenticated users...

WordPress Tipsacarrier plugin access control error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...