PT-2024-17751 · Arista · Arista Ng Firewall

Name of the Vulnerable Software and Affected Versions: Arista NG Firewall affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code...

WordPress Download Manager plugin <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files vulnerability

Improper Authorization to Unauthenticated Download of Password-Protected Files vulnerability discovered by Emiliano Versini in WordPress Plugin Download Manager versions = 3.3.03...

Improper Authorization

apachesuperset is vulnerable to Improper Authorization. The vulnerability is due to improper authorization checks, where SQL DML statements are incorrectly identified as read-only queries, allowing attackers to bypass security restrictions and execute potentially malicious SQL queries...

CVE-2024-12539

An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow...

CVE-2024-12539

Elasticsearch vulnerability CVE-2024-12539: improper authorization controls could bypass Document Level Security, allowing access to documents beyond user roles. Connected sources indicate affected Elastic Stack versions (notably referenced security update 8-16-2 to 8-17-0) and a security bulleti...

Exploit for CVE-2024-44765

CVE-2024-44765https://nvd.nist.gov/vuln/detail/CVE-2024-447...

CVE-2024-9654

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...

CVE-2024-9654

CVE-2024-9654 concerns Easy Digital Downloads for WordPress (versions 3.1–3.3.4). The issue is Improper Authorization in verify_guest_email, allowing unauthenticated attackers to view other users’ purchase receipts (which include a download link). Exploitation requires knowledge of another custom...

CVE-2024-9654 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...

CVE-2024-9654 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...

CVE-2024-54125

The CVE-2024-54125 entry relates to the Shonen Jump+ Android app prior to version 4.0.0. The issue is improper restriction of Custom URL Schemes (CWE-939), allowing a malicious actor to direct a user to arbitrary websites through the app, which can lead to phishing. Connected sources confirm the ...

CVE-2024-54125

Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

Elastic Elasticsearch 安全漏洞

Elastic Elasticsearch is a search engine based on the Lucene library from the Dutch company Elastic. A security vulnerability exists in Elastic Elasticsearch versions 8.16.0 and 8.16.1 that stems from improper authorization controls and allows malicious actors to bypass document-level security an...

WordPress Easy Digital Downloads plugin 3.1-3.3.4 - Improper Authorization to Paywall Bypass vulnerability

Improper Authorization to Paywall Bypass vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Easy Digital Downloads versions 3.1-3.3.4...

SAP NetWeaver AS ABAP Privilege Escalation (3536361)

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single...

CVE-2024-49071

Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network...

GHSA-787V-V9VQ-4RGV Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

Improper Authorization

Overview apache-superset is a modern, enterprise-ready business intelligence web application. Affected versions of this package are vulnerable to Improper Authorization through the SQLLab component. An attacker can execute unauthorized write operations by crafting a specially designed SQL DML...

CVE-2024-55633

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...