PT-2024-14991 · Extreme Networks · Extreme Xds

Name of the Vulnerable Software and Affected Versions: Extreme XDS versions prior to 3914 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS, allowing Authentication Abuse. Recommendations: For versions prior to 3914,...

AlmaLinux 8 : grafana (ALSA-2024:1646)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1646 advisory. - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled...

RHEL 9 : Red Hat build of MicroShift 4.14.19 (RHSA-2024:1566)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1566 advisory. Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the ed...

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...

VMware SD-WAN Orchestrator 安全漏洞

VMware SD-WAN Orchestrator is a software from VMware that is used to orchestrate network data flows in a software-defined network architecture. The software provides web pages to visualize and manage users, gateways, and authentication. A security vulnerability exists in VMware SD-WAN Orchestrato...

The vulnerability of the FortiOS operating system, related to bypassing authentication by using a user-controlled key, allows a perpetrator to gain unauthorized access to confidential information.

The vulnerability of the FortiOS operating system relates to bypassing authentication by using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential information...

CVE-2024-31095

Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0...

CVE-2024-30543

Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18...

CVE-2024-30543

CVE-2024-30543 is an authorization bypass via a user-controlled key in the UPQODE Whizz/Whizzy WordPress plugin, affecting versions from n/a to 1.1.18. The CVSS 3.1 base score is 6.5 (Network attack, Low attack complexity, Privileges Required: None, User Interaction: None, Confidentiality/Integri...

CVE-2024-31095 WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0...

CVE-2024-31095 WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

A vulnerability in Ricard Torres Thumbs Rating thumbs-rating.This issue affects Thumbs Rating: from n/a through = 5.1.0...

PT-2024-23763 · Unknown · Thumbs Rating

Name of the Vulnerable Software and Affected Versions: Thumbs Rating versions 5.1.0 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects the Thumbs Rating software. Recommendations: For Thumbs Rating version...

CVE-2024-30513

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2...

CVE-2024-30513

CVE-2024-30513 weakly documented in the provided sources is described as an Authorization Bypass Through User-Controlled Key in ProfileGrid (Metagauss ProfileGrid), affecting ProfileGrid versions up to 5.7.2. Connected documents corroborate the authorisation bypass context and link to PatchStack ...

CVE-2024-30507 WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7...

PT-2024-23434 · Molongui · Molongui

Name of the Vulnerable Software and Affected Versions: Molongui versions through 4.7.7 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects Molongui, allowing for potential unauthorized access. Recommendations: For...

PT-2024-23441 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.7.2 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid. Recommendations: For versions through 5.7.2, update to a version lat...

Authorization Bypass

@oneuptime/common-server and @oneuptime/model are vulnerable to Authorization Bypass Through User-Controlled Key. The vulnerability is due to improper validation of the ismasteradmin key stored in the browser local storage. Attackers can manipulate this key from false to true, granting themselves...

Authorization Bypass

Grafana vulnerable to Authorization Bypass Through User-Controlled Key. The vulnerability is due to insufficient validation of organization IDs in the DeleteDashboardSnapshot within dashboardsnapshot.go. This allows an attacker to bypass authorization and delete a snapshot by sending a DELETE...

CVE-2024-28233

JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API...