Thelia authentication bypass vulnerability

An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.0.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1...

PT-2024-40295 · Thelia · Thelia

Name of the Vulnerable Software and Affected Versions: thelia/thelia versions 2.1.0-beta1 through 2.1.2 Description: An authentication bypass issue was identified, affecting both customer and admin authentication. Recommendations: For thelia/thelia versions 2.1.0-beta1 through 2.1.2, update to...

SUSE CVE-2023-41038

Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long CHAR length, which causes the...

CVE-2023-41038

Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long CHAR length, which causes the...

BIT-DISCOURSE-2023-40588 Discourse DoS via 2FA and Security Key Names

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

CentOS 9 : pki-core-11.3.0-0.2.beta1.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the pki- core-11.3.0-0.2.beta1.el9 build changelog. - Improper authentication/authorization with caServerKeygenDirUserCert profile CVE-2022-2393 Note that Nessus has not tested for this iss...

GHSA-8PJX-JJ86-J47P Grafana path traversal

Today we are releasing Grafana 8.3.1, 8.2.7, 8.1.8, 8.0.7. This patch release includes a high severity security fix that affects Grafana versions from v8.0.0-beta1 through v8.3.0. Release v8.3.1, only containing a security fix: - Download Grafana 8.3.1 - Release notes Release v8.2.7, only...

Mulvad VPN Security Breach

Mulvad VPN is Mulvad's Mulvad VPN client application for desktop and mobile devices. A security vulnerability exists in Mulvad VPN Windows prior to version 2023.6-beta1, which stems from insufficiently restricted directory permissions that allow any local, non-privileged user to escalate...

PT-2023-31553 · Mullvad · Mullvad Vpn Windows App

Name of the Vulnerable Software and Affected Versions: Mullvad VPN Windows app versions prior to 2023.6-beta1 Description: An issue was discovered in the Mullvad VPN Windows app, where insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM...

Discourse 3.1.x <= 3.1.1, 3.2.0.beta1 Unauthorized Access Vulnerability

Discourse is prone to an unauthorized access vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse";...

Sql injection

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead in arbitrary code execution by an admin-privileg...

Sql injection

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead in arbitrary code execution by an admin-privileg...

CVE-2023-38218 Incorrect Authorization - Customer account takeover

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation...

CVE-2023-38218 Incorrect Authorization - Customer account takeover

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation...

PT-2023-5986 · Adobe · Commerce +1

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-beta1 through 2.4.4-p5 Description: The issue is related to the lack of protection of the web page structure in Magento Open Source and Adobe Commerce, allowing a remote attacker to conduct cross-site scripting...

Economizzer user enumeration vulnerability

The commit 3730880 April 2023 and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or...

GHSA-PQ98-6HF6-3RJ3 Economizzer remote code execution vulnerability

A remote code execution RCE vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 April 2023. A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and...

GHSA-GC95-5MMP-MP6J Economizzer vulnerable to Clickjacking

The commit 3730880 April 2023 and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were...

CVE-2023-38877

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 April 2023. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server...

Design/Logic Flaw

The commit 3730880 April 2023 and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were...