PT-2023-14167 · WordPress · Wholesale Market

Name of the Vulnerable Software and Affected Versions: Wholesale Market WordPress plugin versions prior to 2.2.1 Description: The issue allows unauthenticated attackers to download arbitrary files from the server due to the lack of authorization checks and validation of user input used to generat...

Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. PoC Run the below command in the developer console of the web browser while being on the blog as an unauthenticated user,...

CVE-2022-43872

IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information e.g. event log entries about the FTM SWIFT system. IBM X-Force ID: 239708...

Authorization

IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information e.g. event log entries about the FTM SWIFT system. IBM X-Force ID: 239708...

CVE-2022-43872 IBM Financial Transaction Manager information disclosure

IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information e.g. event log entries about the FTM SWIFT system. IBM X-Force ID: 239708...

CVE-2022-43872 IBM Financial Transaction Manager information disclosure

IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information e.g. event log entries about the FTM SWIFT system. IBM X-Force ID: 239708...

PT-2022-27038 · Ibm · Ibm Financial Transaction Manager

Name of the Vulnerable Software and Affected Versions: IBM Financial Transaction Manager version 3.2.4 Description: The issue concerns incorrect authorization checks for certain HTTP requests, allowing unauthorized access to technical information, such as event log entries, about the FTM SWIFT...

Tuleap 安全漏洞

Tuleap is an open source application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A security vulnerability exists in versions prior to Tuleap 14.2.99.148, which stems from failure to proper...

Miele appWash Access Control Error Vulnerability

Miele appWash is a laundry room digitization app from Miele Germany. Miele appWash suffers from an Access Control Error vulnerability that stems from the use of an API endpoint to bypass authorization checks. An attacker could use this vulnerability to gain read and partial write access to data...

Cisco Secure Email and Web Manager Information Disclosure (cisco-sa-cnt-sec-infodiscl-BVKKnUG)

According to its self-reported version, Cisco Secure Email and Web Manager is affected by an information disclosure vulnerability that could allow an authenticated, remote attacker to retrieve sensitive information from an affected device, including user credentials. This vulnerability is due to...

CVE-2022-20942

A vulnerability in the web-based management interface of Cisco Email Security Appliance ESA, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance WSA, could allow an authenticated, remote attacker to retrieve sensitive information from...

CVE-2022-20942

A vulnerability in the web-based management interface of Cisco Email Security Appliance ESA, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance WSA, could allow an authenticated, remote attacker to retrieve sensitive information from...

WordPress plugin Automatic User Roles Switcher 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in the WordPress...

CVE-2020-35539

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2022-26230 · Unknown · Online Birth Certificate Management System

Name of the Vulnerable Software and Affected Versions: Online Birth Certificate Management System version 1.0 Description: The issue is related to an Insecure Direct Object Reference IDOR vulnerability. This means that the system may allow unauthorized access to sensitive information by...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in the Matrix iOS SDK prior to version 0.23.19, which stems from a lack of required checks in matrix-ios-sdk...

CVE-2022-39960

The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a plugins/servlet/groupexportforjira/admin/ URI...

Authorization

The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a plugins/servlet/groupexportforjira/admin/ URI...

CVE-2022-39960

The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a plugins/servlet/groupexportforjira/admin/ URI...

CVE-2022-39960

The CVE-2022-39960 issue affects the Netic Group Export add-on for Atlassian Jira, prior to version 1.0.3. The extension does not perform authorization checks, enabling an unauthenticated user to export all groups by calling groupexport_download=true on plugins/servlet/groupexportforjira/admin/. ...