Exploit for Insertion of Sensitive Information Into Sent Data in Cern Indico

CVE-2024-50633 🏆 - CVE-2024-50633: Indico BOLA Vuln...

PT-2024-39941

Name of the Vulnerable Software and Affected Versions Jetpack WordPress plugin affected versions not specified Description The issue concerns a flaw in one of the Jetpack WordPress plugin's REST endpoints, specifically lacking proper authorization. This flaw allows any authenticated user, such as...

Dreamehome 2.1.5 Broken Authorization

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Broken authorization product: Dreamehome app vulnerable version: =2.1.5 iOS fixed version: none, see solution CVE number: - impact: medium homepage:...

CVE-2023-3066 Mobatime mobile application - Broken authorisation

Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20...

CVE-2023-3033 Mobatime web application - broken authorisation mechanisms

Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22...

CVE-2023-2179: Undefined Security Weakness

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making...

CVE-2023-0889: Undefined Security Weakness

Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, suc...

CVE-2022-39233

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users ca...

CVE-2022-36051 Broken Authorization in ZITADEL Actions

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...

CVE-2022-36051 Broken Authorization in ZITADEL Actions

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...

CVE-2022-34770

Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API’s, has in its URL one or more MongoD...

CVE-2021-24757: Incorrect Authorization

The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spluploadserimg AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload images...

PT-2021-2965

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services Software WAAS affected versions not specified Description The issue is related to improper input validation and authorization of specific commands that a user can execute within the Command Line Interface...

PT-2021-2202

Name of the Vulnerable Software and Affected Versions: Cisco Data Center Network Manager affected versions not specified Description: The issue is related to the implementation of the REST API interface in the Cisco Data Center Network Manager system, which is associated with the use of an...

CVE-2018-17178: Undefined Security Weakness

An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands sent to /bin/webserver on port 8081 if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed even though th...

CVE-2016-5422: Undefined Security Weakness

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

CVE-2014-3345: Undefined Security Weakness

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503...