CVE-2023-24489

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller...

Design/Logic Flaw

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller...

CVE-2023-3574

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

CVE-2023-3574 Improper Authorization in pimcore/customer-data-framework

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

CVE-2023-3574 Improper Authorization in pimcore/customer-data-framework

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

CVE-2023-3574

CVE-2023-3574 : The issue affects pimcore/customer-data-framework prior to 3.4.1, where improper authorization checks allow an unauthorized actor to access resources or perform actions. The Red Hat/Veracode/GHSA entries corroborate the same vulnerability description. A patch is available: upgrade...

CVE-2023-3574 Improper Authorization in pimcore/customer-data-framework

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1...

Pimcore 安全漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A security vulnerability exists in Pimcore...

WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Broken Access Control

Software WooCommerce Ship to Multiple Addresses Type Plugin Vulnerable versions = 3.8.5 Fixed in 3.8.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-37872 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7919a835fac3 Credits...

PT-2023-25293 · Pimcore · Pimcore/Customer-Data-Framework

Name of the Vulnerable Software and Affected Versions: pimcore/customer-data-framework versions prior to 3.4.1 Description: The product performs authorization checks incorrectly, allowing an unauthorized actor to access resources or perform actions. This enables the attacker to view and freely ad...

JumpCloud Resets API Keys Amid Ongoing Cybersecurity Incident

JumpCloud, a provider of cloud-based identity and access management solutions, has swiftly reacted to an ongoing cybersecurity incident that impacted some of its clients. As part of its damage control efforts, JumpCloud has reset the application programming interface API keys of all customers...

Authorization

Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization...

PT-2023-14067 · Solusvm +1 · Solusvm +1

Name of the Vulnerable Software and Affected Versions: WHMCS module SolusVM version 1.4.1.2 Description: The issue allows an attacker to change the password and hostname of other customer servers without authorization due to an Insecure Direct Object Reference vulnerability. Recommendations: For...

website 信任管理问题漏洞

website is a library from Challenge open source. Contains files for the new DIKULAN website not dependent on Joomla. website Version 0.1.0 suffers from a Trust Management Issues vulnerability that stems from the presence of Sensitive Information Exposure, which can be exploited by an attacker to...

Reentrancy may allow a customer to steal funds

Lines of code Vulnerability details Impact The reentrancy in the vested token can be used by a customer if the execution can be hijacked before the balance change occurs. Let’s consider function withdraw. Firstly, the balance is checked and then if there is enough token surplus to withdraw, the...

Tennessee Valley Authority: Admin.MyTVA.com Customer lookup and internal notes bypass

The admin.mytva.com site had a vulnerability that allowed an attacker to bypass the login and access admin-only endpoints. This could lead to unauthorized access to customer information and the ability to add internal notes...

Top contenders in Endpoint Security revealed: G2 Summer 2023 results

Navigating the world of endpoint security is challenging, with numerous vendors stoking "Fear, Uncertainty, and Doubt" FUD and making bold claims that are difficult to verify. In times like these, the honest opinions of real users are invaluable for busy IT teams. Enter G2, an industry-leading...

CVE-2023-3427

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

CVE-2023-3427 Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

PT-2023-24785 · WordPress · Salon Booking System

Name of the Vulnerable Software and Affected Versions: The Salon Booking System plugin for WordPress versions up to, and including, 8.4.6 Description: The issue is due to missing or incorrect nonce validation on the save customer function, making it possible for unauthenticated attackers to chang...