CVE-2023-3285: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-38052: Authorization Bypass Through User-Controlled Key

A BOLA vulnerability in GET, PUT, DELETE /admins/adminId allows a low privileged user to fetch, modify or delete a high privileged user admin. This results in unauthorized access and unauthorized data manipulation...

PT-2024-12345

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "POST /secretaries" endpoint allows a low-privileged user to create a low-privileged user secretary in the system, resulting i...

PT-2024-12683

Name of the Vulnerable Software and Affected Versions No specific software name or affected versions are mentioned in the provided descriptions. Description A BOLA vulnerability in the "GET, PUT, DELETE /appointments/appointmentId" endpoint allows a low-privileged user to fetch, modify, or delete...

CVE-2023-41918

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-41918 Missing Authentication for Critical Function in Kiloview P1/P2 devices

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-41918

CVE-2023-41918 is linked to Kiloview P1/P2 devices. Multiple connected sources describe unauthenticated access to functionality inadequately constrained by ACLs, potentially enabling unauthenticated command execution, data manipulation, or access to privileged functions. Some documents allege bro...

CVE-2023-41918 Missing Authentication for Critical Function in Kiloview P1/P2 devices

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

Vulnerabilities discovered in Kiloview P1 4G Video Encoder and P2 4G Video Encoder

Vulnerabilities have been discovered in Kiloview P1 and P2. Kiloview P1 and P2 are hardware solutions for streaming image information in HDMI format. The firmware of these systems contains a number of serious vulnerabilities that allow a malicious person to perform attacks that can lead to the...

CVE-2023-41918: Missing Authentication for Critical Function

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

The vulnerability of the JSONHandler component in the PyMySQL library for the Python programming language allows a hacker to gain unauthorized access to data, falsify data, or execute arbitrary code on the database server’s internal side.

The vulnerability of the JSONHandler component in the PyMySQL library for the Python programming language is related to the lack of a key escrow mechanism in the process of escapedict. Exploiting this vulnerability may allow an attacker to gain unauthorized access to data, falsify data, or execut...

CVE-2024-2882: Missing Authorization

SDG Technologies PnPSCADA allows a remote attacker to attach various entities without requiring system authentication. This breach could potentially lead to unauthorized control, data manipulation, and access to sensitive information within the SCADA system...

PT-2024-22589

Name of the Vulnerable Software and Affected Versions SDG Technologies PnPSCADA affected versions not specified Description The issue allows a remote attacker to attach various entities without requiring system authentication, potentially leading to unauthorized control, data manipulation, and...

CVE-2024-5071

The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent when booking an appointment the request body to change its status from pending to approved...

CVE-2024-5071

The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent when booking an appointment the request body to change its status from pending to approved...

PT-2024-34395 · WordPress · The Bookster

Name of the Vulnerable Software and Affected Versions: The Bookster WordPress plugin versions prior to 1.1.1 Description: The issue allows attackers to manipulate the data sent when booking an appointment by adding sensitive parameters when validating appointments, potentially changing the status...

VulnCheck KEV: CVE-2020-13965

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview...

CVE-2024-30119 HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header

HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection...

CVE-2024-30119 HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header

HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection...

CVE-2024-30119: Insufficiently Protected Credentials

HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection...