Authorization Bypass

io.github.microcks, microcks is vulnerable to Authorization Bypass. The vulnerability is caused due to a missing validation around POST /api/import and POST /api/export endpoints. This leads to Authorization bypass...

Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access

In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...

CVE-2024-44076

In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...

Microcks security vulnerabilities

Microcks is an open source Kubernetes tool for API mocking and testing. A security vulnerability exists in Microcks versions prior to 1.10.0 that stems from the POST /api/import and POST /api/export endpoints allowing non-administrative access...

CVE-2024-44076

In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...

CVE-2024-44076: Improper Privilege Management

In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...

CVE-2024-43318 WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through = 1.25.05...

PT-2024-30938 · Microcks · Microcks

Name of the Vulnerable Software and Affected Versions: Microcks versions prior to 1.10.0 Description: The issue allows non-administrator access to the "POST /api/import" and "POST /api/export" endpoints. Recommendations: For versions prior to 1.10.0, update to version 1.10.0 or later to resolve t...

WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin e2pdf versions = 1.25.05...

CVE-2024-42966

Incorrect access control in TOTOLINK N350RT V9.3.5u.6139B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh...

PT-2024-38327 · WordPress · Newsletters

Name of the Vulnerable Software and Affected Versions: The Newsletters plugin for WordPress versions up to, and including, 4.9.9 Description: The issue is due to the plugin not preventing direct access to the "/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php" API endpoint. This allows...

PT-2024-38621 · Unknown · Sourcecodester Online Graduate Tracer System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Graduate Tracer System version 1.0 Description: A problematic issue has been found in the system, affecting some unknown processing of the file /tracking/admin/export it.php, leading to information disclosure. The attack...

PT-2024-6833 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the handling of trusted keys in the Linux kernel. Specifically, when importing a trusted DCP-based key and then exporting it again, the blob encryption key BEK ...

TOTOLINK N350RT security vulnerabilities

The TOTOLINK N350RT is a small home router from China's Gion Electronics TOTOLINK. The TOTOLINK N350RT suffers from an Access Control Error vulnerability that originates from an Access Control Error vulnerability contained in the /cgi-bin/ExportSettings.sh file. No details of the vulnerability ar...

TOTOLINK LR350 security vulnerabilities

TOTOLINK LR350 is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK LR350 suffers from an Access Control Error vulnerability that originates from an Access Control Error vulnerability contained in the /cgi-bin/ExportSettings.sh file. No details of the vulnerability are provid...

SourceCodester Online Graduate Tracer System has a vulnerability related to information leakage

SourceCodester Online Graduate Tracer System is a web-based application project developed by SourceCodester using PHP and MySQL database. Its main purpose is to provide a platform for a school to track their alumni and generate graphical reports on alumni status. An information disclosure...

Exploit for CVE-2024-4956

CVE-2024-4956 All information is provided for informational...

CVE-2024-39416 Unauthorized user can export Orders Sale Report

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information...

FortiAIOps GUI Arbitrary Command Execution

The vulnerability of the export function of the graphical user interface of the artificial intelligence-based security threat detection software FortiAIOps relates to the absence of a mechanism to neutralize elements in the CSV file. Exploiting this vulnerability allows an attacker operating...

CVE-2024-38787

Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through = 1.26.8...