Broken Access Control in 3rd party TYPO3 extension "femanager"

A missing access check in the InvitationController allows an unauthenticated user with a valid invitation link to set the password of all frontend users...

GHSA-3P9X-XXX6-2W4P Broken Access Control in 3rd party TYPO3 extension "femanager"

A missing access check in the InvitationController allows an unauthenticated user to delete all frontend users...

CVE-2023-25014

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users...

Design/Logic Flaw

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users...

CVE-2023-25014

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users...

CVE-2023-25014

CVE-2023-25014 affects the TYPO3 femanager extension (pre-5.5.3, pre-6.3.4 in 6.x, and pre-7.1.0 in 7.x). The root cause is missing access checks in the InvitationController, enabling an unauthenticated user to delete all frontend users. Reported across multiple feeds (NVD, Red Hat, GHSA/OSV, etc...

CVE-2023-25014

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users...

CVE-2023-25013

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users...

Malicious code in searchband-frontend-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf78480d464f5f670ccc0e60161d713925b077a538b1790e0ca75b27f3e1bc6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-767 Malicious code in searchband-frontend-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf78480d464f5f670ccc0e60161d713925b077a538b1790e0ca75b27f3e1bc6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DC-Sonar - Analyzing AD Domains For Security Risks Related To User Accounts

DC Sonar Community Repositories The project consists of repositories: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Disclaimer It's only for education purposes. Avoid using it on the production Active Directory AD domain. Neither contributor incur any responsibilit...

VulnCheck KEV: CVE-2021-24139

Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...

OpenText Extended ECM 22.3 Java Frontend Remote Code Execution Vulnerability

======================================================================= title: Pre-authenticated Remote Code Execution via Java frontend and QDS endpoint product: OpenText™ Content Server component of OpenText™ Extended ECM vulnerable version: 20.4 - 22.3 fixed version: 22.4 CVE number:...

media_upload 路径遍历漏洞

mediaupload is a Fluid widget provided for mass uploading media on the front-end using HTML5 technology. A path traversal vulnerability exists in mediaupload. An attacker could use this vulnerability to access files and directories stored outside of the web root folder...

USN-5789-1: Linux kernel (OEM) vulnerabilities

It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-43945 Jann Horn discovered that the...

CVE-2014-125032

CVE-2014-125032 affects porpeeranut go-with-me; a SQL injection exists in the file module/frontend/add.php . The vulnerability results from manipulation of the noted file’s functionality, enabling likely unauthorized data access or modification. A patch identified as b92451e4f9e85e26cf493c95ea0a6...

PT-2023-10102 · Unknown · Porpeeranut Go-With-Me

Name of the Vulnerable Software and Affected Versions: porpeeranut go-with-me affected versions not specified Description: A critical issue has been identified, affecting an unknown functionality of the file module/frontend/add.php, which leads to sql injection. Recommendations: To resolve this...

a2ml (>=0.1.0 <=0.1.2), aadetools (>=0.0.3 <=0.0.5) +627 more potentially affected by CVE-2022-40898 via wheel (>=0.24.0 <=0.38.0)

wheel PYPI version =0.24.0, =0.1.0, =0.0.3, =0.1.1, =0.1.0, =1.0.0, =0.14.0, =1.4.6, =1.0.1, =1.0.17, =3.9.0, =2.4.1, =0.0.1, =1.0.1 and more Source cves: CVE-2022-40898 Source advisory: OSV:GHSA-QWMP-2CF2-G9G6...

Authentication Bypass

typo3/cms and typo3/cms-core are vulnerable to authentication bypass. Restricting frontend login to specific users are organized in different storage folders partitions, and can be bypassed, which allows an authenticated attacker to gain access to a different account when credentials are known...

CVE-2022-23501

TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders partitions, can be bypassed. A...